Direct Volume Access
- ID
- T1006
- Tactics
- TA0005 Stealth
- Platforms
- Network Devices, Windows
- Data sources
- Process Access, Process Creation, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.[1]
Utilities, such as NinjaCopy, exist to perform these actions in PowerShell.[2] Adversaries may also use built-in or third-party utilities (such as vssadmin, wbadmin, and esentutl) to create shadow copies or backups of data from system volumes.[3]
Detection
- DET0426 Detection of Direct Volume Access for File System Evasion
Data components: Process Access, Process Creation, Command Execution
Mitigations (2)
- M1018 User Account Management
Ensure only accounts required to configure and manage backups have the privileges to do so. Monitor these accounts for unauthorized backup activity.
- M1040 Behavior Prevention on Endpoint
Some endpoint security solutions can be configured to block some types of behaviors related to efforts by an adversary to create backups, such as command execution or preventing API calls to backup related services.