9 Sysmon log · RawAccessRead high severity low volume

Sysmon Event ID 9 — RawAccessRead detected

A process used \\.\PHYSICALDRIVE0 or similar raw disk access. Image and Device are key.

Why event 9 matters

Raw disk access for credential harvesting (reading NTDS.dit or SAM hive directly from disk, bypassing file locks). Tools: NTDSUtil, vssadmin, certain data recovery tools. Ransomware may use raw disk access for encryption. Also used by disk forensic tools.

How to detect it

Alert: Image is not a known backup or forensic tool. Alert: Device is a drive letter or physical disk. Cross-reference with 4663 file access events.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic Technique
Credential Access NTDS (T1003.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Raw Disk Read
status: experimental
description: Raw disk access from unexpected process
author: theadminstack.com
date: 2026/05/16
logsource:
    category: raw_access_read
    product: windows
detection:
    selection:
        EventID: 9
    filter_legit:
        Image|contains:
            - 'backup'
            - 'vss'
            - 'dfsr'
    condition: selection and not filter_legit
falsepositives:
    - Disk backup software
    - Forensic tools
level: high
tags:
    - attack.credential_access
    - attack.t1003.003
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 9   // RawAccessRead detected
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=9
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# RawAccessRead detected — add EventData fields: Image, CommandLine, ParentImage, User`
Hunt event 9 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 9?

RawAccessRead detected. A process used \\.\PHYSICALDRIVE0 or similar raw disk access. Image and Device are key.

Which log records event 9?

Event 9 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 9?

Event 9 is associated with: NTDS (T1003.003).

How do you detect activity around event 9?

Alert: Image is not a known backup or forensic tool. Alert: Device is a drive letter or physical disk. Cross-reference with 4663 file access events.