Direct disk device access
Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Attackers abuse raw disk handles to read partition structures, extract volume data, or wipe MBR/VBR without triggering standard file-level auditing, making it a common primitive in data destruction malware, ransomware, pre-encryption volume enumeration, and stealthy credential harvesting tools that read NTFS structures directly.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Evasión de defensas
- Técnicas MITRE: T1006