ATT&CK technique
View on MITRE ATT&CK →
T1006
Direct Volume Access
Stealth
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | NTDS Dump via Wbadmin | production | 2026-09-18 |
| elastic | DebugFS Execution Detected via Defend for Containers | production | 2026-09-18 |
| elastic | File System Debugger Launched Inside a Container | production | 2026-09-18 |
| elastic | Potential Suspicious DebugFS Root Device Access | production | 2026-09-18 |
| elastic | TCC Bypass via Mounted APFS Snapshot Access | production | 2026-09-18 |
| elastic | PowerShell Invoke-NinjaCopy script | production | 2026-09-18 |
| elastic | Symbolic Link to Shadow Copy Created | production | 2026-09-18 |
| sigma | Potential Defense Evasion Via Raw Disk Access By Uncommon Tools | test | 2025-12-03 |