Process command line references a raw volume or device path

Siemphony@siemphonylowT1006unverified

AN1193's `TargetObjectPattern` knob asks for a match against `\Device\HarddiskVolume` or `\.\PhysicalDrive*`, but the analytic's own process_access log source (Sysmon EventID 10) cannot carry it: that event's only path-shaped field is `TargetImage`, the process being accessed, which is always an executable path and never a device path, so a selector built on it would parse, render and never fire. Process creation is the one field set left in the brief that can hold the pattern at all, and only where the device path is spelled out on the command line rather than passed through an API — the case the technique description gives directly: `esentutl`'s `/vss` switch snapshotting a database for raw copy, and the `\Device\`, `PhysicalDrive` and `GLOBALROOT` literals that show up when a tool like NinjaCopy or a shadow-copy-based extractor is invoked with the target spelled out. A script that opens the handle programmatically without ever writing the device path to its own command line — the more common shape for NinjaCopy specifically — leaves no trace here; that is a real gap, not a false positive, and nothing in this brief's two log sources closes it. This category maps to Security EventID 4688 in the brief, not Sysmon EventID 1, so it returns nothing by default: it needs the *Audit Process Creation* subcategory enabled, and separately the *Include command line in process creation events* policy, or `CommandLine` is logged empty and every selector above is silently blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0426, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "PhysicalDrive" or ProcessCommandLine contains "HarddiskVolume" or ProcessCommandLine contains "GLOBALROOT") or (FolderPath endswith "\\esentutl.exe" and ProcessCommandLine contains "/vss"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*PhysicalDrive*" OR CommandLine="*HarddiskVolume*" OR CommandLine="*GLOBALROOT*") OR (Image="*\\esentutl.exe" AND CommandLine="*/vss*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*physicaldrive*" OR TO_LOWER(process.command_line) LIKE "*harddiskvolume*" OR TO_LOWER(process.command_line) LIKE "*globalroot*") OR (TO_LOWER(process.executable) LIKE "*\\\\esentutl.exe" AND TO_LOWER(process.command_line) LIKE "*/vss*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(PhysicalDrive|HarddiskVolume|GLOBALROOT)</field>    <description>Process command line references a raw volume or device path (1/2)</description>    <mitre>      <id>T1006</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\esentutl\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)/vss</field>    <description>Process command line references a raw volume or device path (2/2)</description>    <mitre>      <id>T1006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: kernel_and_firmware_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ee6ff189-ea3d-466c-a3bb-96ed818737e7

ATT&CKT1006

T1006Direct Volume Access

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonkernel and firmware tampering

kernel and firmware tamperingAI draft — unreviewed

01 · What this rule detects

A process command line that names a raw device path directly — \Device\HarddiskVolume, PhysicalDrive or a GLOBALROOT-prefixed shadow- copy path — or esentutl.exe invoked with its /vss switch to snapshot a database for raw copy. AN1193's own TargetObjectPattern knob asks for exactly these path shapes; this rule catches the case the technique description gives directly, where the device path is spelled out on the command line rather than passed through an API call the log source can't see at all.

02 · Telemetry you need

category: process_creation, product: windows. The brief maps this analytic to Security EventID 4688, not Sysmon EventID 1 — a distinction that matters because 4688's CommandLine field is not populated by default. It needs the Audit Process Creation subcategory plus the separate Include command line in process creation events policy enabled; without both, every selector below returns zero rows that read as "no raw volume access happening" when the real state is "this feed is off." That gap was in the original description as a limitation but not as an audit prerequisite until this review added the sentence naming the two policies.

03 · How the logic works

Two independent selections, condition: 1 of selection*:

selection_esentutl_vss is tight — a specific binary plus a specific switch. selection_device_path is deliberately loose: it has no Image gate at all, because AN1193's process_access source (Sysmon EventID 10) can't carry the device-path pattern — its only path field is TargetImage, the process being accessed, never a device path — so process creation is the only field set left that can hold it, and only for tools that write the path onto their own command line rather than calling the API directly. NinjaCopy and similar extractors more often build the handle programmatically without ever touching their own command line; that's a real coverage gap this rule doesn't close, not a false positive.

04 · Common false positives

The description calls out backup and imaging software — Windows Server Backup, Macrium, Acronis — opening \\.\PhysicalDriveN or \\Device\\HarddiskVolumeN by design for sector-level backup, plus forensic tools like FTK Imager and WinPmem doing the same for legitimate collection; on any host with scheduled backups this is, in the rule's own words, "the highest-volume match by a wide margin." Also expect esentutl /vss run as scheduled maintenance against Windows Search, WSUS or DHCP's own ESE databases — the documented, non-malicious use of that exact switch — and Volume Shadow Copy consumers unrelated to credential theft, including System Restore and third-party snapshot-based sync tools, referencing GLOBALROOT paths when restoring or scanning a snapshot.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0426, never executed against a log line. The 4688 command-line prerequisite this review added is untested against a real environment's audit policy, and selection_device_path's lack of a tool gate is an accepted, named tradeoff rather than an oversight.
tier_2: needs both the audit-policy check and a pass at excluding known backup infrastructure before this is more than scaffolding.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Confirm the 4688 audit policies are actually enabled before trusting a quiet result from either selector — that check comes first, not last. Exclude known backup and imaging service accounts and their scheduled task names from selection_device_path by User or parent process. For selection_esentutl_vss, correlate with the target database path: matches against WSUS, Windows Search or DHCP's own .edb files are the documented maintenance case and can be suppressed by path, leaving matches against ntds.dit or unexpected targets as the higher-signal remainder. Don't raise level above low while the dominant match is unfiltered backup traffic.

Declared by the author

Backup, imaging and disk-cloning software (Windows Server Backup, Macrium, Acronis and similar) that opens \. hysicalDriveN or \Device\HarddiskVolumeN by design for sector-level backup, and forensic/incident-response imaging tools (FTK Imager CLI, WinPmem) doing the same for a legitimate collection. On any host running scheduled backups this is the highest-volume match by a wide margin.
esentutl /vss run against Windows Search, WSUS or DHCP's own ESE databases as scheduled maintenance or repair, which is the documented, non-malicious use of the same switch cited in the technique description.
Volume Shadow Copy service consumers unrelated to credential theft — System Restore, third-party snapshot-based sync tools and some antivirus scanners reference GLOBALROOT shadow-copy device paths in their own command lines when restoring or scanning a snapshot.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1006, evaluated against their process_creation events.

Share this rule

/u/siemphony/ee6ff189-ea3d-466c-a3bb-96ed818737e7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process command line references a raw volume or device path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it