SHARE

Raw Disk Reads: The EDR Blind Spot Threat Actors Love

Attackers use raw disk reads to evade EDR and steal Windows credential files, exposing a major blind spot in enterprise defenses.

Written By

Ken Underhill

Sep 5, 2025

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

Threat actors can bypass security tools and steal sensitive Windows files by directly reading raw disk data.

A new analysis by Workday found that the technique bypasses endpoint detection and response (EDR) tools, file permissions, and even advanced safeguards like virtualization-based security (VBS). They warn that this blind spot leaves critical Windows credential files vulnerable to theft.

“With the increasing availability of tools for AI-assisted programming these attacks are becoming more accessible,” Workday researchers wrote in a Sept. 4 blog post.

How attackers reconstruct sensitive files

Unlike typical malware behavior, this attack never issues a standard “open file” call through APIs like CreateFile or ReadFile. Instead, it bypasses the filesystem entirely and communicates directly with low-level disk drivers to request raw sector data.

To most EDR tools, this looks like an innocuous operation — a request to “read sector 12345” — rather than a sensitive attempt to open SAM.hive or NTDS.dit. Since most security products key their detections to file paths and file handles, these sector-level reads slip by undetected.

Once attackers have access to raw disk data, the challenge shifts from reading bytes to reassembling files. This requires parsing the NTFS filesystem structures that describe how data is organized on disk.

To reconstruct files from raw disk reads, an attacker parses the disk step by step: first reading the MBR or GPT to locate NTFS partitions, then the Volume Boot Record (VBR) for layout details and the Master File Table (MFT) location.

The MFT acts as a directory, storing metadata and “data runs” that map files to disk clusters. By following these mappings, attackers can reconstruct sensitive files such as SAM.hive or NTDS.dit directly from raw sectors, bypassing the operating system entirely.

The attack underscores a major security blind spot

Workday’s team showed how this works in practice by exploiting a vulnerability in the eudskacs.sys driver that allowed unprivileged userspace applications to request arbitrary sector reads. The driver accepted offsets directly from user input and passed them to disk.sys without validation, effectively exposing the entire disk to low-privileged processes.

While this proof-of-concept leveraged a vulnerable third-party driver, the researchers emphasized that administrators don’t need a vulnerability at all because Windows’ own built-in disk drivers (disk.sys, storport.sys, etc.) already provide the necessary interfaces if an attacker has elevated privileges.

This approach is stealthy because EDR tools monitor file-level API calls, not low-level sector reads. Raw disk access avoids file handles altogether, bypassing ACLs, LSASS file locks, and audit logs, leaving little to no forensic trace.

The attack highlights a major blind spot for security teams: traditional monitoring solutions are often designed to track access requests by filename, not sector-level reads. This means malicious actors can steal critical credential files—such as the Windows SAM hive—without raising red flags.

What your organization can do to prevent this attack

Defending against this type of low-level attack is challenging, but not impossible. The researchers recommend a layered “defense in depth” approach:

Enable full disk encryption to render raw disk data unreadable without the encryption key.
Restrict and monitor privileges by limiting admin rights and auditing privileged activity.
Harden driver security through strict ACLs, blocking unsigned or vulnerable drivers, and using Microsoft’s driver blocklist.
Use the Driver Verifier in testing to detect unsafe behaviors and input validation flaws before deployment.
Monitor for raw disk access using tools like Sysmon (Event ID 9), applying filters to minimize noise.
Strengthen endpoint and response by combining EDR with kernel-level monitoring and updating incident response plans.

While raw disk access is not a new concept, its proven ability to bypass modern EDRs underscores a broader challenge because attackers are increasingly operating below the visibility of traditional defenses.

As threat actors continue to innovate below the operating system layer, enterprises should assume that EDR alone is insufficient and prioritize layered defense such as encryption, privilege restrictions, and proactive monitoring to close visibility gaps.

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.