Which SIEM platforms have a T1006 detection rule?

df00tech provides T1006 (Direct Volume Access) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Direct Volume Access (T1006)?

Detecting Direct Volume Access requires the following data sources: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint.

What severity and confidence is the T1006 detection?

The T1006 detection is rated high severity with high confidence.

What are common false positives for T1006?

Common false positives for T1006 include: Legitimate backup software (Veeam, Acronis, Windows Server Backup) uses VSS APIs and vssadmin/wbadmin to create and manage shadow copies as part of normal backup jobs — correlate with scheduled backup windows; Database administrators using esentutl for legitimate NTDS or Exchange database maintenance, repair, or integrity checks — verify against change management tickets; Windows built-in System Restore and automatic shadow copy creation triggered by system updates or restore point schedules — check InitiatingProcessFileName for svchost.exe or vssvc.exe as parent.

T1006 IBM QRadar · QRadar

Detect Direct Volume Access in IBM QRadar

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes, enabling reads and writes directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls and file system monitoring tools. Utilities such as NinjaCopy (PowerShell), vssadmin, wbadmin, and esentutl can be used to create shadow copies or access locked files (such as ntds.dit, SYSTEM hive, and SAM) directly from disk. Real-world actors including Scattered Spider and Volt Typhoon have leveraged Volume Shadow Copy Service (VSS) to extract credential stores without triggering standard file access controls.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1006 Direct Volume Access
Canonical reference: https://attack.mitre.org/techniques/T1006/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceHost,
  username AS UserName,
  "ProcessImage" AS ProcessImage,
  "CommandLine" AS CommandLine,
  "ParentImage" AS ParentProcess,
  CASE
    WHEN LOWER("CommandLine") LIKE '%ntds.dit%'
      OR LOWER("CommandLine") LIKE '%ntds.jfm%'
      OR LOWER("CommandLine") LIKE '%ntuser.dat%'
      OR LOWER("CommandLine") LIKE '%security.bak%'
      THEN 'Critical'
    WHEN "ProcessImage" LIKE '%powershell.exe'
      OR "ProcessImage" LIKE '%pwsh.exe'
      OR "ProcessImage" LIKE '%ntdsutil.exe'
      OR "ProcessImage" LIKE '%esentutl.exe'
      THEN 'High'
    ELSE 'Medium'
  END AS RiskScore,
  CASE
    WHEN "ProcessImage" LIKE '%vssadmin.exe'   THEN 'ShadowCopyManagement'
    WHEN "ProcessImage" LIKE '%esentutl.exe'   THEN 'EsentutlVSS'
    WHEN "ProcessImage" LIKE '%diskshadow.exe' THEN 'DiskShadow'
    WHEN "ProcessImage" LIKE '%ntdsutil.exe'   THEN 'NtdsutilIFM'
    WHEN "ProcessImage" LIKE '%wbadmin.exe'    THEN 'WindowsBackup'
    WHEN "ProcessImage" LIKE '%powershell.exe'
      OR "ProcessImage" LIKE '%pwsh.exe'       THEN 'PowerShellVolumeAccess'
    ELSE 'DirectVolumeAccess'
  END AS ToolCategory
FROM events
WHERE
  (
    (
      "ProcessImage" LIKE '%vssadmin.exe' AND
      ("CommandLine" LIKE '%create shadow%' OR "CommandLine" LIKE '%list shadow%' OR "CommandLine" LIKE '%delete shadow%')
    ) OR (
      "ProcessImage" LIKE '%esentutl.exe' AND
      ("CommandLine" LIKE '%HarddiskVolumeShadowCopy%' OR "CommandLine" LIKE '%GLOBALROOT%'
        OR "CommandLine" LIKE '%/y %' OR "CommandLine" LIKE '%/vss%')
    ) OR
      "ProcessImage" LIKE '%diskshadow.exe'
    OR (
      "ProcessImage" LIKE '%ntdsutil.exe' AND
      ("CommandLine" LIKE '%ifm%' OR "CommandLine" LIKE '%activate instance%' OR "CommandLine" LIKE '%ntds%')
    ) OR (
      "ProcessImage" LIKE '%wbadmin.exe' AND
      ("CommandLine" LIKE '%start backup%' OR "CommandLine" LIKE '%start recovery%')
    ) OR (
      ("ProcessImage" LIKE '%powershell.exe' OR "ProcessImage" LIKE '%pwsh.exe') AND
      ("CommandLine" LIKE '%NinjaCopy%' OR "CommandLine" LIKE '%Invoke-NinjaCopy%'
        OR "CommandLine" LIKE '%PhysicalDrive%' OR "CommandLine" LIKE '%HarddiskVolumeShadowCopy%'
        OR "CommandLine" LIKE '%GLOBALROOT%')
    ) OR
      "CommandLine" LIKE '%PhysicalDrive%'
    OR
      "CommandLine" LIKE '%GLOBALROOT%HarddiskVolumeShadowCopy%'
  )
ORDER BY starttime DESC
LAST 24 HOURS

critical severity high confidence

IBM QRadar AQL query detecting T1006 Direct Volume Access against Sysmon process creation events normalized via WinCollect DSM. Queries custom properties ProcessImage and CommandLine (populated by the Microsoft Windows Sysmon DSM parser) for VSS tool abuse, direct volume path access, and PowerShell raw disk API usage. Risk scoring and tool categorization are computed inline. Note: custom property names vary by DSM configuration — adjust ProcessImage and CommandLine field references to match your QRadar deployment's Sysmon DSM property mappings.

Data Sources

IBM QRadar with Microsoft Windows WinCollect agent (Sysmon Event ID 1)Windows Security Event Log via WinCollect (Event ID 4688 with process command-line auditing enabled)QRadar Microsoft Windows Sysmon DSM for custom property extraction

Required Tables

events

False Positives & Tuning

Enterprise backup solutions (Veeam Backup & Replication, Commvault, NetBackup, SCDPM) running on backup servers invoke vssadmin.exe and wbadmin.exe routinely during scheduled jobs — expect sustained false positive volume from backup infrastructure hosts
Active Directory infrastructure teams creating IFM installation media for domain controller promotion using ntdsutil.exe 'activate instance ntds' and 'ifm' commands — indistinguishable from attacker use without additional context on the initiating account and host
PowerShell-based infrastructure automation scripts that reference HarddiskVolume paths for disk health checks, storage management, or scripted backup operations will match the PowerShellVolumeAccess category

Download portable Sigma rule (.yml)

Other platforms for T1006

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1VSS Shadow Copy Creation and NTDS Extraction via esentutl
Expected signal: Sysmon Event ID 1: Process Create for vssadmin.exe with CommandLine containing 'create shadow /for=C:'. Second Sysmon Event ID 1: esentutl.exe with CommandLine containing the \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy path and '/vss'. Security Event ID 4688 for both processes if command line auditing is enabled. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation. Sysmon Event ID 11 (File Create) for SYSTEM.bak in %TEMP%.
Test 2Diskshadow Script-Based Shadow Copy and File Exposure
Expected signal: Sysmon Event ID 1: diskshadow.exe with CommandLine containing '/s' and the .dsh script path. Sysmon Event ID 11: creation of dsh_test.dsh in %TEMP% by powershell.exe. Security Event ID 4688 for diskshadow.exe. Microsoft-Windows-StorageService/Operational events for VSS snapshot creation via diskshadow. If drive Z: is exposed, subsequent file access on Z: generates normal file system events attributed to the accessing process.
Test 3ntdsutil IFM Media Creation for NTDS Extraction
Expected signal: Sysmon Event ID 1: ntdsutil.exe with CommandLine containing 'ifm', 'create full', and the output path. Security Event ID 4688 for ntdsutil.exe. On a domain controller: Security Event ID 4656/4663 for NTDS directory handle access, and Sysmon Event ID 11 for file creation of ntds.dit and SYSTEM in the IFM output directory. On a non-DC: ntdsutil exits with an error (0x80070003 - path not found for NTDS) but process creation event still fires.
Test 4PowerShell Direct Physical Drive Read Simulation
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing '\\.\PhysicalDrive0' and 'FileOpen'. Security Event ID 4688 if command line auditing is enabled. If Object Access auditing covers raw disk handles: Security Event ID 4656 for handle request to PhysicalDrive0. This command will fail with 'Access Denied' for non-elevated users, but the process creation event still fires and matches the detection pattern.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1006 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Related Techniques

T1003.002Security Account Manager T1003.003NTDS T1059.001PowerShell T1490Inhibit System Recovery T1055Process Injection T1078.002Domain Accounts T1560Archive Collected Data T1048Exfiltration Over Alternative Protocol T1485Data Destruction

Detect Direct Volume Access in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1006

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1006

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox