Raw Volume Access Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.