Event ID 9: RawAccessRead
Contents
Event ID 9: RawAccessRead¶
Version: 4.81¶
Description¶
The RawAccessRead event detects when a process conducts reading operations from the drive. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.
Data Dictionary¶
Field Name |
Type |
Description |
Sample Value |
|---|---|---|---|
RuleName |
string |
custom tag mapped to event. i.e ATT&CK technique ID |
|
UtcTime |
date |
Time in UTC when event was created |
|
ProcessGuid |
string |
Process Guid of the process that conducted reading operations from the drive |
|
ProcessId |
integer |
Process ID used by the os to identify the process that conducted reading operations from the drive |
|
Image |
string |
File path of the process that conducted reading operations from the drive |
|
Device |
string |
Target device |
|
User |
string |
Name of the account that read. |
|