Volt TyphoonG1017 ↗
Has executed the Windows-native vssadmin command to create volume shadow copies.1
tfMITRE ATT&CK technique
Direct Volume Access T1006
- Tactic
- Stealth
- Platforms
- Network Devices, Windows
- Version
- 3.0
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- Tom Simpson, CrowdStrike Falcon OverWatch
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 46% of ATT&CK techniques have fewer threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.