Sigma rule: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools

Rule

Title

Potential Defense Evasion Via Raw Disk Access By Uncommon Tools

Status

test

Level

low

Author

Teymur Kheirkhabarov, oscd.community

Date

2019-10-22

Modified

2025-12-03

File

rules/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

Log source

product

windows

category

raw_access_thread

Detection

filter_main_floppy:
    Device|contains: floppy
filter_main_generic:
    Image|startswith:
        - 'C:\$WINDOWS.~BT\'
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\CCM\'
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\servicing\'
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SystemApps\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\uus\'
        - 'C:\Windows\WinSxS\'
filter_main_system_images:
    Image:
        - 'Registry'
        - 'System'
filter_main_windefender:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith:
        - '\MsMpEng.exe'
        - '\MpDefenderCoreService.exe'
filter_main_microsoft_appdata:
    Image|startswith: 'C:\Users\'
    Image|contains|all:
        - '\AppData\'
        - '\Microsoft\'
filter_main_ssd_nvme:
    Image|startswith: 'C:\Windows\Temp\'
    Image|endswith:
        - '\Executables\SSDUpdate.exe'
        - '\HostMetadata\NVMEHostmetadata.exe'
filter_main_null:
    Image: null
filter_main_systemsettings:
    Image: 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
filter_main_update:
    Image|startswith: 'C:\$WinREAgent\Scratch\'
filter_optional_github_desktop:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\GitHubDesktop\app-'
    Image|endswith: '\resources\app\git\mingw64\bin\git.exe'
filter_optional_nextron:
    Image|startswith: 'C:\Windows\Temp\asgard2-agent\'
    Image|endswith: '\thor.exe'
filter_optional_Keybase:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Keybase\upd.exe'
condition: not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Likely

Tags

• attack.stealth
• attack.t1006

MITRE ATT&CK ids this rule names

• T1006

References

• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml