Direct Volume Access and Offline Credential Dumping via SMB Raw Volume Path

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.