Detection of Direct Volume Access via PowerShell IO.FileStream

This brief addresses the risk of unauthorized direct disk volume access initiated through PowerShell. Attackers leverage the .NET IO.FileStream class to interact with volume objects using the Windows DOS device path syntax (starting with '\\.\'). By accessing the raw volume handle, threat actors can bypass standard Windows API restrictions, potentially reading sensitive data or examining raw file system structures. This technique is often associated with efforts to circumvent file-level security, perform stealthy data exfiltration, or inspect disk sectors for forensic artifacts. Defenders must monitor PowerShell Script Block Logging for the instantiation of IO.FileStream objects targeting raw device paths to identify potential administrative abuse or malicious post-exploitation activity.

Impact

Successful exploitation allows an adversary to read raw data from disk volumes, potentially bypassing file system permissions, auditing, and access control lists (ACLs). This can lead to the exposure of sensitive files, configuration data, or security logs that are otherwise protected from standard user-mode access.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across all endpoints to capture the full command syntax necessary for detection.
• Deploy the provided Sigma rule to identify instances where the IO.FileStream class is used in conjunction with device path identifiers.
• Investigate detected activity to determine if it stems from administrative scripts or unauthorized post-exploitation tools.