Cross-source coverage

T1006 / ATT&CK

Direct Volume Access

11 rules · 10 families across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.

Utilities, such as NinjaCopy, exist to perform these actions in PowerShell. Adversaries may also use built-in or third-party utilities (such as vssadmin, wbadmin, and esentutl) to create shadow copies or backups of data from system volumes.

Tactics
Stealth
Platforms
Network Devices · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Securitynetworkdevice:cli

How MITRE says to detect it DET0426

Detection of Direct Volume Access for File System Evasion

Windows Analytic 1193

Processes accessing raw logical drives (e.g., \.\C:) to bypass file system protections or directly manipulate data structures.

  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Security EventCode=4688

Network Devices Analytic 1194

CLI or automated utilities accessing raw device volumes or flash storage directly (e.g., via `copy flash:`, `format`, or `partition` commands).

  • networkdevice:cli command logging

View on attack.mitre.org ↗

elastic/detection-rules

7 rules
Detection Severity Format
PowerShell Invoke-NinjaCopy script High Elastic TOML
TCC Bypass via Mounted APFS Snapshot Access High Elastic TOML
DebugFS Execution Detected via Defend for Containers Medium Elastic TOML
File System Debugger Launched Inside a Container Medium Elastic TOML
NTDS Dump via Wbadmin Medium Elastic TOML
Symbolic Link to Shadow Copy Created Medium Elastic TOML
Potential Suspicious DebugFS Root Device Access Low Elastic TOML

socfortress/Wazuh-Rules

3 rules · 2 families
Detection Severity Format
Detects access to a raw disk on a host to evade detection by security products. 2 variants High Wazuh XML
Detects access to a raw disk on a host to evade detection by security products. 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Direct Volume Access PowerShell (T1006) High Wazuh XML

SigmaHQ/sigma

1 rule
Detection Severity Format
Potential Defense Evasion Via Raw Disk Access By Uncommon Tools Low Sigma

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.