Raw Disk Access Via Mknod dd

Tim Peck@timpeck

•updated Apr 6, 2026•12•0•1,997

Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.