T1006Stealth
Direct Volume Access
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. Utilities, such…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
1 Sigma rule tagged T1006Direct Volume AccessT10061 general rule
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Direct Volume Access
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.