[DevCop95]

Summary of Changes

Adds the file createnew subcommand to yml/OSBinaries/Fsutil.yml.

fsutil.exe file createnew <filename> <length> creates a valid file of an arbitrary size instantaneously on NTFS volumes without writing zeroes or allocating content blocks upfront. Standard unprivileged users can execute this command in any directory where they have write privileges (e.g., %TEMP%, user profiles).

Adversary Usecase & Threat Context

• Technique / Objective: Tampering & Defense Impairment (Primary MITRE ATT&CK: T1562.001 - Impair Defenses; Secondary: T1499 - Endpoint DoS).
• Threat actors and evasion proof-of-concepts (such as BigDiskBuster) utilize rapid, zero-overhead file allocation to fill the system/staging drive to 0 bytes remaining. This halts automated security operations, including:
  • Starving the staging storage for Windows Defender definition and platform updates (ProgramData\Microsoft\Windows Defender\Platform\...), leaving the endpoint running outdated signatures while the service superficially reports healthy.
  • Halting local logging and telemetry buffers (e.g., Windows Event Log / EDR local cache).
  • Inducing denial of service on local storage without dropping external compilers or third-party binaries.

Detection & Telemetry

• Sysmon Event ID 1 (Process Creation): Execution of fsutil.exe containing file createnew in the command-line arguments.
• Sysmon Event ID 11 (FileCreate): Sudden generation of massive files in temporary or user directories.
• Windows System Event ID 2013: "The disk is at or near capacity" alert triggered upon exhaustion.

Attribution & References

• Technique Origin & Offensive PoC: MSNightmare (BigDiskBuster).
• Defensive Modeling, Telemetry & Documentation: DevCop95 (BDB-Guardian).
• Official Documentation: Microsoft Learn - fsutil file.

Verification & Environment Tested

• Tested on: Windows 11 Pro (25H2, Build 10.0.26200.9457) and Windows 10.
• Execution Context: Tested under a standard non-elevated user context in %TEMP% (fsutil file createnew %TEMP%\test.tmp <bytes>). File pre-allocation completes instantaneously without requiring elevated administrator rights.
• Schema Validation: Conforms strictly to LOLBAS YAML schema specifications.
• CI Pre-checks: Verified locally against .github/workflows/validation.py (Pydantic validation passed cleanly) and .github/.yamllint (yamllint passed with 0 errors/warnings).

[wietze]

@DevCop95 Clever technique, thanks for adding this to the project.