All Detections

Windows Direct Volume Boot Sector via DOS Device Path

avatar
Danny Y@zendannyy
updated Jun 20, 2026003

Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.

Sigma