Skip to content
Threat Feed
Subscribe

Tag

Raw-Disk-Access

2 briefs RSS
critical advisory

Suspicious Raw Disk Access Detected

Detection of processes accessing raw disk volumes outside of normal system paths, often associated with wiper malware and boot sector attacks.

Windows raw-disk-access wiper boot-sector
2r 1t
critical advisory

Detecting Windows Raw Access to Master Boot Record

This analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR) using Sysmon EventCode 9, which is a common tactic used by attackers to wipe, encrypt, or overwrite the MBR as part of their impact payload.

Windows raw-disk-access mbr sysmon data-destruction
2r 1t