Direct Volume Access (T1006) is a stealth technique. Adversaries directly access a volume to bypass file access controls and file system monitoring. MITRE lists Windows and network devices as platforms.
How attackers use it
Windows lets programs open logical volumes directly. A program with that access can read and write files by analyzing file system data structures, which may bypass Windows file access controls and file system monitoring tools. MITRE names NinjaCopy, a PowerShell utility, as an example of this approach.
MITRE adds that adversaries may use built-in or third-party utilities such as vssadmin, wbadmin and esentutl to create shadow copies or backups of data from system volumes. The copies are then readable even when the originals are locked.
The practical effect is that a file your permissions and auditing protect may still be read through another door.
How to detect it
MITRE's analytic watches two things:
- Processes accessing raw logical drives, for example paths that name a drive volume directly, to bypass file system protections or change data structures.
- On network devices, command line use or automation that touches raw device volumes or flash storage directly, such as copy flash, format or partition commands.
For Windows, use process creation events with command lines to catch vssadmin, wbadmin and esentutl. Add file system or volume access events where your endpoint tool provides them. For network devices, use command accounting.
Unexpected backup creation by a user that does not run backups is the easiest signal.
How to reduce the risk
MITRE lists two mitigations:
- Behavior Prevention on Endpoint: some endpoint security solutions can be configured to block behaviors tied to making backups, such as command execution or API calls to backup services.
- User Account Management: only accounts needed to configure and manage backups should have those privileges. Monitor those accounts for unauthorized backup activity.
Why this one matters for backups
The same utilities that make backups also create copies that bypass normal file protections. A locked database file, or a protected system file, can be copied through a shadow copy or a backup tool without touching the file path that your auditing watches. That is the reason MITRE's mitigations focus on who may run backup tools.
Practical steps
- Maintain a short list of accounts that may create backups and shadow copies, and keep it in your access reviews.
- Log process creation with command lines on servers, so use of backup utilities is visible.
- Alert on backup utilities run by anyone outside the list, or at times outside your backup window.
- Review where backup output goes. A backup written to a local folder or a share the operator controls is a staging area.
Network devices
On network devices, raw access to flash and device storage is rare. Command accounting that records copy and format commands, sent to a central server, gives you the history even if the device is later tampered with.
Tuning
Backup windows are predictable. Compare activity against the schedule, and treat anything outside it as a question to answer. Most findings turn out to be an administrator taking a snapshot before a change, which is fine once it is explained, and which is a reason to ask people to log changes in a ticket.
Check your own environment
- Which accounts can run backup tools? Compare the list with your backup operators.
- Are shadow copies expected on your servers? If not, any new one is noteworthy.
To list shadow copies on a Windows host from an elevated prompt (vssadmin, read-only):
vssadmin list shadows
Quick check
Why can direct volume access slip past file monitoring?
The program reads the disk structures directly instead of asking the operating system for the file, so file access controls and file-level monitoring may never see the read.
