All Detections

Suspicious IO.FileStream

avatar
SigmaHQ Detections@sigmaHQ
updated Mar 5, 2022000

Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

Sigma