From eec22fae25bbfa84b1182d75b7063ca81ea6c761 Mon Sep 17 00:00:00 2001
From: DevCop95 <yared.henriquezb@gmail.com>
Date: Mon, 21 Sep 2026 10:09:59 -0500
Subject: [PATCH 1/2] feat(Fsutil): add 'file createnew' command for disk space
 exhaustion / defense impairment

---
 yml/OSBinaries/Fsutil.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/yml/OSBinaries/Fsutil.yml b/yml/OSBinaries/Fsutil.yml
index 28593e482..ea94ea967 100644
--- a/yml/OSBinaries/Fsutil.yml
+++ b/yml/OSBinaries/Fsutil.yml
@@ -27,18 +27,27 @@ Commands:
     OperatingSystem: Windows 11
     Tags:
       - Execute: EXE
+  - Command: fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}
+    Description: Instantly creates a new file of any specified size to exhaust free disk space.
+    Usecase: Exhaust available disk space to impair defensive tools (such as preventing Windows Defender definition updates) or cause endpoint denial of service.
+    Category: Tamper
+    Privileges: User
+    MitreID: T1562.001
+    OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
 Full_Path:
   - Path: C:\Windows\System32\fsutil.exe
   - Path: C:\Windows\SysWOW64\fsutil.exe
 Detection:
   - IOC: fsutil.exe should not be run on a normal workstation
   - IOC: file setZeroData (not case-sensitive) in the process arguments
+  - IOC: file createnew (not case-sensitive) in the process arguments
   - IOC: Sysmon Event ID 1
   - IOC: Execution of process fsutil.exe with trace decode could be suspicious
   - IOC: Non-Windows netsh.exe execution
   - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml
 Resources:
   - Link: https://twitter.com/0gtweet/status/1720724516324704404
+  - Link: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
 Acknowledgement:
   - Person: Elliot Killick
     Handle: '@elliotkillick'
@@ -46,3 +55,5 @@ Acknowledgement:
     Handle: '@bohops'
   - Person: Grzegorz Tworek
     Handle: '@0gtweet'
+  - Person: DevCop95
+    Handle: '@DevCop95'

From 379f928a1c5977116a3fa43de3e49f4e84a48a3b Mon Sep 17 00:00:00 2001
From: DevCop95 <yared.henriquezb@gmail.com>
Date: Mon, 21 Sep 2026 10:26:33 -0500
Subject: [PATCH 2/2] docs(Fsutil): expand threat context, logging impact, and
 research attribution

---
 yml/OSBinaries/Fsutil.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Fsutil.yml b/yml/OSBinaries/Fsutil.yml
index ea94ea967..ecff0a73b 100644
--- a/yml/OSBinaries/Fsutil.yml
+++ b/yml/OSBinaries/Fsutil.yml
@@ -29,7 +29,7 @@ Commands:
       - Execute: EXE
   - Command: fsutil.exe file createnew {PATH_ABSOLUTE} {LENGTH_IN_BYTES}
     Description: Instantly creates a new file of any specified size to exhaust free disk space.
-    Usecase: Exhaust available disk space to impair defensive tools (such as preventing Windows Defender definition updates) or cause endpoint denial of service.
+    Usecase: Exhaust available disk space to impair defensive tools (preventing Windows Defender updates and halting local logging) or cause endpoint denial of service.
     Category: Tamper
     Privileges: User
     MitreID: T1562.001
@@ -42,12 +42,15 @@ Detection:
   - IOC: file setZeroData (not case-sensitive) in the process arguments
   - IOC: file createnew (not case-sensitive) in the process arguments
   - IOC: Sysmon Event ID 1
+  - IOC: Sysmon Event ID 11
   - IOC: Execution of process fsutil.exe with trace decode could be suspicious
   - IOC: Non-Windows netsh.exe execution
   - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml
 Resources:
   - Link: https://twitter.com/0gtweet/status/1720724516324704404
   - Link: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
+  - Link: https://github.com/MSNightmare/BigDiskBuster
+  - Link: https://github.com/DevCop95/BDB-Guardian
 Acknowledgement:
   - Person: Elliot Killick
     Handle: '@elliotkillick'
@@ -55,5 +58,7 @@ Acknowledgement:
     Handle: '@bohops'
   - Person: Grzegorz Tworek
     Handle: '@0gtweet'
+  - Person: MSNightmare
+    Handle: '@MSNightmare'
   - Person: DevCop95
     Handle: '@DevCop95'