How do attackers use RawDisk?

Attackers use RawDisk to gain direct raw disk access on Windows and bypass normal file and volume controls. That access can help them read or modify data, interfere with security tools or manipulate forensic evidence. Defenders should treat raw disk access as high risk, restrict driver installation and alert on unusual low-level disk activity.

How RawDisk changes the attacker playbook on Windows

RawDisk matters because it shifts access from normal file operations to raw, low-level disk access. That lets an attacker bypass many of the guardrails Windows normally applies to files and volumes, so the disk can be read or written more directly. The practical result is greater control over data, and a better chance of interfering with security tooling or tampering with evidence.

That same capability is why low-level access is often treated as a step up in offensive capability rather than just another utility. When an attacker can work beneath the filesystem layer, they can target structures that are harder for ordinary user-mode controls to monitor consistently, which raises the value of driver abuse, stealth, and persistence.

For defenders, the key point is that RawDisk is not just about copying data faster. It can change what is visible to endpoint tools and what remains trustworthy after a suspected intrusion, so it belongs in the same mental bucket as other mechanisms that expand local control beyond ordinary application boundaries.

What attackers can do once they have raw disk access

Raw disk access can support several offensive goals at once. An attacker may read sensitive content directly from disk, modify data without using normal file APIs, or attempt to suppress traces that would normally help analysts reconstruct what happened. In practice, that can mean manipulating artefacts, weakening recovery confidence, or creating inconsistencies between what the operating system reports and what is actually stored on disk.

It can also interfere with defensive visibility. Security products that rely on file-level telemetry, volume metadata, or standard access paths may see less of the activity than they would from ordinary process behaviour. That does not make detection impossible, but it does mean defenders often need to look for driver installation, unusual device access, and suspicious low-level I/O patterns rather than only user-space process events.

NHIMG’s Malware Guide is useful context here because RawDisk is most often discussed as a technique that sits inside broader malware behaviour, including evasion, tampering, and post-compromise manipulation.

Why raw disk activity is a security signal, not a normal admin task

On a well-managed Windows environment, raw disk access should be uncommon and justified. The risk is not only that the access exists, but that it can be used to cross a boundary normally enforced by the filesystem, volume manager, and endpoint security stack. That makes the behaviour worth treating as a high-confidence signal when it appears outside a known maintenance workflow.

This is especially true when the activity is paired with driver installation, service creation, disabled protections, or attempts to access storage devices directly from untrusted processes. Those combinations can indicate an effort to evade controls, not just to perform administration. Raw disk use also matters during incident response because it can affect the reliability of evidence and the integrity of disk-based forensic assumptions.

CISA cyber threat advisories are a useful reference point for recognising the kinds of attacker behaviour that often accompany low-level access, including persistence, tampering, and tool interference.

Risk and Threat Considerations

Raw disk access increases both exposure and attacker leverage because it can bypass normal file permissions and reduce the reliability of host-based monitoring. If an attacker already has local execution, raw disk access can help them pivot from ordinary compromise into deeper tampering, stealth, or evidence manipulation.

Failure mechanism: The attacker obtains a privileged driver or equivalent low-level path to the storage stack, then uses it to read, modify, or interfere with data below the normal file and volume control layer.

Impact: Security tools may miss activity, investigators may inherit corrupted evidence, and the attacker may gain a stronger position for hiding changes or impeding recovery.

Practitioner Guidance

What to verify: Confirm whether any software on the system has a legitimate need for raw disk access, then check whether that need is narrowly scoped and time-bound. If the access is not tied to a known maintenance, backup, or forensic workflow, treat it as suspicious until proven otherwise.

Common mistake: Focusing only on file creation or process execution events can miss the more important signal. A driver or service that enables direct storage access may be the real control failure, even if the visible process activity looks ordinary.

What practitioners underestimate: The impact is not limited to data theft. Low-level disk access can also undermine confidence in logs, snapshots, backups, and forensic artefacts, which makes post-incident analysis and recovery harder than it first appears.

Practitioner takeaway: Treat unexplained raw disk access as a boundary violation, not a niche artifact, and prioritise driver governance and low-level storage monitoring before assuming the problem is only data access.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?