Suspicious PowerShell Direct Volume Access via IO.FileStream

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects PowerShell scripts attempting to open a handle to a drive volume using the `IO.FileStream` object and the `\\.\` DOS device path specifier. This technique is often used for direct access to the volume, bypassing standard file system controls.