T1006 Direct Volume Access — Attack Simulation

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. Utilities, such as `NinjaCopy`, exist to perform these actions in…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Read volume boot sector via DOS device path (PowerShell)
windows automated powershell
Procedure 88f6327e-51ec-4bbf-b2e8-3fea534eab8b; elevation required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem Network Devices Windows stealth isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate technique source_mapped

Detection and collection

T1006 detection workspace

Attack tools

esentutl · S0404

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.