File System Utility
fsutil.exe file setZeroData offset=0 length=9999999999 C:\Windows\Temp\payload.dll
Zero out a file
Can be used to forensically erase a file
C:\Windows\System32\fsutil.exe, C:\Windows\SysWOW64\fsutil.exe
IOC: fsutil.exe should not be run on a normal workstation, IOC: file setZeroData (not case-sensitive) in the process arguments, Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml
Elliot Killick (@elliotkillick), Jimmy (@bohops)