T1006
Direct Volume Access
Network Devices · Windowsnothing on this site yetT1006 on attack.mitre.org
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. Utilities, such as `NinjaCopy`, exist to perform these actions in PowerShell.
how MITRE says to see it
Detection of Direct Volume Access for File System Evasion
- Processes accessing raw logical drives (e.g., \.\C:) to bypass file system protections or directly manipulate data structures.
- CLI or automated utilities accessing raw device volumes or flash storage directly (e.g., via `copy flash:`, `format`, or `partition` commands).
what reduces it
- M1040 Behavior Prevention on Endpoint. Some endpoint security solutions can be configured to block some types of behaviors related to efforts by an adversary to create backups, such as command execution or preventing API calls to backup related services.
- M1018 User Account Management. Ensure only accounts required to configure and manage backups have the privileges to do so. Monitor these accounts for unauthorized backup activity.