Raw Disk Access via SSH for Volume Bypass

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.