Direct Volume Access via Raw Disk Read over SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to access physical drives directly over SMB by looking for the string "\\.\PhysicalDrive" in TCP traffic on port 445. This technique can be used by attackers to bypass file system access controls and directly read or write to disk sectors, often as part of defense evasion or data exfiltration.