MITRE ATT&CK technique

Direct Volume Access detection rulesT1006

Direct Volume Access (T1006) is a MITRE ATT&CK technique in the Stealth tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1006 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1006 on attack.mitre.org1 rule

Tactic

Stealth

Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
low
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
windows · raw_access_thread

Top products

Tactic

Potential Defense Evasion Via Raw Disk Access By Uncommon Tools