1200KM / detection
T1006 Direct Volume Access — Detection Rules
Detection workspace for T1006 Direct Volume Access: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Potential Defense Evasion Via Raw Disk Access By Uncommon Tools · test · low · {"product":"windows","category":"raw_access_thread"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0426 Detection of Direct Volume Access for File System Evasion
AN1193 Analytic 1193
Processes accessing raw logical drives (e.g., \.\C:) to bypass file system protections or directly manipulate data structures.
AN1194 Analytic 1194
CLI or automated utilities accessing raw device volumes or flash storage directly (e.g., via `copy flash:`, `format`, or `partition` commands).
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.