Direct disk device access
Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Attackers abuse raw disk handles to read partition structures, extract volume data, or wipe MBR/VBR without triggering standard file-level auditing, making it a common primitive in data destruction malware, ransomware, pre-encryption volume enumeration, and stealthy credential harvesting tools that read NTFS structures directly.
- Platform: Windows
- Severity: High
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1006