Techniques › T1006
T1006 Direct Volume Access
stealth — Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
1
Sigma rules tagged attack.t1006
0
KEV CVEs mapped here
<p>Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.</p><p>Utilities, such as
NinjaCopy, exist to perform these actions in PowerShell. Adversaries may also use built-in or third-party utilities (such as vssadmin, wbadmin, and esentutl) to create shadow copies or backups of data from system volumes.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0426 Detection of Direct Volume Access for File System Evasion v1.0
AN1193 WindowsProcesses accessing raw logical drives (e.g., \.\C:) to bypass file system protections or directly manipulate data structures.Tunable:
TargetObjectPatternParentProcessTimeWindowAN1194 Network DevicesCLI or automated utilities accessing raw device volumes or flash storage directly (e.g., viacopy flash:,format, orpartitioncommands).Tunable:CommandScopeDeviceTypeFilter
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1006
Author: Teymur Kheirkhabarov, oscd.community
· 2019-10-22 (modified 2025-12-03) · logsource: product=windows category=raw_access_thread · db809f10-56ce-4420-8c86-d6a7d793c79c
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts