Potential Defense Evasion Via Raw Disk Access By Uncommon Tools

Severity: low
Author: Teymur Kheirkhabarov, oscd.community
Source: upstream

Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1006` Direct Volume Access

Event coverage

Provider	Event ID	Title
Sysmon	9	RawAccessRead

Stages and Predicates

Stage 1: `not 1 of filter_main_*`

or:
or:
Image|endswith: '\Executables\SSDUpdate.exe'
Image|endswith: '\HostMetadata\NVMEHostmetadata.exe'
Image|startswith: 'C:\Windows\Temp\'
or:
Image|endswith: '\MpDefenderCoreService.exe'
Image|endswith: '\MsMpEng.exe'
Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
Image|contains: '\AppData\'
Image|contains: '\Microsoft\'
Image|startswith: 'C:\Users\'
Device|contains: floppy
Image: 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
Image: Registry
Image: System
Image: null
Image|startswith: 'C:\$WINDOWS.~BT\'
Image|startswith: 'C:\$WinREAgent\Scratch\'
Image|startswith: 'C:\Program Files (x86)\'
Image|startswith: 'C:\Program Files\'
Image|startswith: 'C:\Windows\CCM\'
Image|startswith: 'C:\Windows\SoftwareDistribution\'
Image|startswith: 'C:\Windows\SysWOW64\'
Image|startswith: 'C:\Windows\System32\'
Image|startswith: 'C:\Windows\SystemApps\'
Image|startswith: 'C:\Windows\WinSxS\'
Image|startswith: 'C:\Windows\explorer.exe'
Image|startswith: 'C:\Windows\servicing\'
Image|startswith: 'C:\Windows\uus\'

Stage 2: `not 1 of filter_optional_*`

or:
Image|endswith: '\resources\app\git\mingw64\bin\git.exe'
Image|contains: '\AppData\Local\GitHubDesktop\app-'
Image|startswith: 'C:\Users\'
Image|endswith: '\thor.exe'
Image|startswith: 'C:\Windows\Temp\asgard2-agent\'
Image|contains: '\AppData\Local\Keybase\upd.exe'
Image|startswith: 'C:\Users\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Device`	match	`floppy`
`Image`	ends_with	`\Executables\SSDUpdate.exe` `\HostMetadata\NVMEHostmetadata.exe` `\MpDefenderCoreService.exe` `\MsMpEng.exe` corpus 13 (sigma 13) `\resources\app\git\mingw64\bin\git.exe` `\thor.exe` corpus 7 (sigma 7)
`Image`	eq	`C:\Windows\ImmersiveControlPanel\SystemSettings.exe` corpus 4 (sigma 4) `Registry` corpus 3 (sigma 3) `System` corpus 8 (sigma 8)
`Image`	match	`\AppData\` corpus 9 (sigma 9) `\AppData\Local\GitHubDesktop\app-` `\AppData\Local\Keybase\upd.exe` `\Microsoft\`
`Image`	starts_with	`C:\$WINDOWS.~BT\` corpus 2 (sigma 2) `C:\$WinREAgent\Scratch\` corpus 2 (sigma 2) `C:\Program Files (x86)\` corpus 14 (sigma 14) `C:\Program Files\` corpus 15 (sigma 15) `C:\ProgramData\Microsoft\Windows Defender\Platform\` corpus 7 (sigma 7) `C:\Users\` corpus 7 (sigma 7) `C:\Windows\CCM\` `C:\Windows\SoftwareDistribution\` corpus 2 (sigma 2) `C:\Windows\SysWOW64\` corpus 16 (sigma 16) `C:\Windows\System32\` corpus 16 (sigma 16) `C:\Windows\SystemApps\` corpus 2 (sigma 2) `C:\Windows\Temp\` corpus 2 (sigma 2) `C:\Windows\Temp\asgard2-agent\` corpus 3 (sigma 3) `C:\Windows\WinSxS\` corpus 13 (sigma 13) `C:\Windows\explorer.exe` `C:\Windows\servicing\` `C:\Windows\uus\` corpus 2 (sigma 2)