tfMITRE ATT&CK technique

Direct Volume Access T1006

Tactic: Stealth
Platforms: Network Devices, Windows
Version: 3.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Tom Simpson, CrowdStrike Falcon OverWatch

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Direct Volume Access MITRE reference T1006

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has executed the Windows-native vssadmin command to create volume shadow copies.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Scattered SpiderG1015 ↗

Has created volume shadow copies of virtual domain controller disks to extract the NTDS.dit file.1

created 2023-07-051 referenceaka Roasted 0ktapus

All 2 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries copied volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.1

2025

APT28 Nearest Neighbor CampaignC0051 ↗

During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.1

2022–2024

All 2 campaigns for this technique

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

esentutlS0404 ↗

Can use the Volume Shadow Copy service to copy locked files such as ntds.dit.1 2

created 2019-09-03TOOLcarried by 3 groups

All 1 software entries for this technique

Offense vs defense T1006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2019 Q4 · 2 of 2 campaigns plotted

Direct Volume Access detection strategy DET0426

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Direct Volume Access for File System Evasion

Enterprise

2 platforms

AN1193 · Windows

Processes accessing raw logical drives (e.g., \.\C:) to bypass file system protections or directly manipulate data structures.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetObjectPattern	Regex pattern to detect access to raw disk volumes like `\Device\HarddiskVolume` or `\.\PhysicalDrive*`.
ParentProcess	Tune for known tools/scripts (e.g., powershell.exe, cmd.exe) often used in misuse scenarios.
TimeWindow	Correlate file access and creation across a short time window to avoid false positives.

AN1194 · Network Devices

CLI or automated utilities accessing raw device volumes or flash storage directly (e.g., via copy flash:, format, or partition commands).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:cli	command logging

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandScope	Limit detection to volume-level commands (e.g., `format`, `copy`, `mount`, `erase`).
DeviceTypeFilter	Filter by internal vs. removable volume interactions (e.g., flash, SD card).

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites0Have cleanup0Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Read volume boot sector via DOS device path (PowerShell) windows PowerShell Required — —

This test uses PowerShell to open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume. On success, a hex dump of the first 11 bytes of the volume is displayed. For a NTFS volume, it should correspond to the following sequence (NTFS partition boot sector)): ``00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 EB 52 90 4E 54 46 53 20 20 20 20 ëR?NTFS``

Input arguments

Name	Type	Default	Description
volume	string	C:	Drive letter of the volume to access

Attack command

$buffer = New-Object byte[] 11
$handle = New-Object IO.FileStream "\\.\#{volume}", 'Open', 'Read', 'ReadWrite'
$handle.Read($buffer, 0, $buffer.Length)
$handle.Close()
Format-Hex -InputObject $buffer

GUID2a8f3beb-3dab-41dd-905f-14873a095201

Tests from Atomic Red Team (MIT licence) · technique definition

Direct Volume Access detections T1006

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs