T1006 — Direct Volume Access

Tactic: Stealth · Platforms: Network Devices, Windows

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This…

Sigma detection rules (2)

T1006 Direct Volume Access

title: T1006 Direct Volume Access
id: cd646799-083a-4518-8610-7643db0405a2
description: 'Detection of Direct Volume Access for File System Evasion. (Retargeted from the original process_creation label to raw_access_thread — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TargetObjectPattern, ParentProcess, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1006
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.stealth
  - attack.t1006

logsource:
  category: raw_access_thread
  product: windows
  service: sysmon

detection:
  selection:
    Device|contains: '\Device\Harddisk'

  filter_defender:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\MpCmdRun.exe'

  condition: selection and not filter_defender

falsepositives:
  - Disk-imaging, backup, or antivirus full-disk-scan tools reading raw volumes; forensic tooling (FTK Imager, dd) will also trigger this.

level: high

T1006 Direct Volume Access

title: T1006 Direct Volume Access
id: 32e1ba02-8831-4ac8-b152-219accebd552
description: 'Detection of Direct Volume Access for File System Evasion. (Data Component: Command Execution; baseline tier: fallback.) This is a Linux-analog proxy for a Windows-scoped ATT&CK technique (raw logical-volume access), not a literal instantiation of T1006; dd/debugfs against raw block devices is the closest equivalent bypass of filesystem-level monitoring on Linux. Now excludes the common unattended/automated backup pattern (root-run, no interactive login session) to reduce noise from scheduled imaging jobs, while still alerting on interactive or non-root invocations. Tune using: CommandScope, DeviceTypeFilter.'
references:
  - https://attack.mitre.org/techniques/T1006
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.stealth
  - attack.t1006

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
    a1|contains:
      - 'if=/dev/sd'
      - 'if=/dev/nvme'
      - 'if=/dev/xvd'
  selection_debugfs:
    type: EXECVE
    a0|endswith: '/debugfs'
  filter_unattended_root_backup:
    auid: 4294967295
    uid: 0

  condition: (1 of selection_*) and not filter_unattended_root_backup

falsepositives:
  - Disk imaging and backup tooling used by administrators for legitimate forensics or cloning also invokes dd and debugfs against raw block devices; the filter above suppresses the common unattended case (root, auid=4294967295, i.e. no real login session, as with cron/systemd-triggered backup jobs) but an admin running the same commands from an interactive session, or any non-root invocation, will still alert and should be triaged against your backup schedule/known service accounts.

level: high

Explore