Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
Detects raw disk access attempts by uncommon tools or tools located in suspicious directories. This activity could indicate defense evasion, potentially to bypass file system monitoring or access controls.
Sigma
