Sysmon Event ID 9: RawAccessRead
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 9 records raw read access to disks or volumes using the \.\ denotation.
Technical Metadata
| Event ID | 9 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0005 Defense Evasion / T1006 Direct Volume Access |
| Key fields to watch | Device, Image / ProcessGuid / ProcessId, UtcTime |
Trigger Scenarios
Microsoft documents that RawAccessRead detects a process conducting reading operations from the drive using \.\ notation, often to bypass file access auditing or read locked files.
Key Fields
Device
The target raw device path, such as \.\C: or \.\PhysicalDrive0, from the official Sysmon schema example.
Image / ProcessGuid / ProcessId
The process that opened the raw device. Microsoft documents these fields in the RawAccessRead schema example.
UtcTime
UTC timestamp used to correlate raw access with backup tools, forensic tools, or suspicious file staging.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 9
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=9
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 9- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 9
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 9
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 9 | A process opened a disk or volume for raw read access. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| Device | \.\PhysicalDrive0 | Windows raw-device notation identifying a physical disk target. | Interpret Device with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1006Direct Volume Access
Detection Notes
Alert when Device is \.\C: or \.\PhysicalDrive0 and Image is not an approved backup, EDR, encryption, or forensic binary. Microsoft documents Event 9 for raw reads using \.\ notation and MITRE T1006 describes direct volume access used to bypass file access controls and monitoring. Correlate ProcessGuid to Event 1 and inspect whether the same process later writes files under C:\Users\, C:\ProgramData\, or C:\Windows\Temp.
Common False Positives
- Backup agents, EDR products, disk encryption tools, forensic tools, and defragmentation utilities may legitimately read raw volumes.
- Baseline approved Image values before treating every raw read as malicious.
Related Events
Sample Log
UtcTime: 2026-07-13 03:01:00.000
ProcessGuid: {REDACTED}
ProcessId: 4812
Image: C:\Users\Public\rawcopy.exe
Device: \.\PhysicalDrive0Frequently Asked Questions
What does Sysmon Event ID 9 mean?
A process read directly from a drive using raw-device access.
Does Event ID 9 always indicate malicious activity?
No. Backup, encryption, EDR, and forensic tools can legitimately perform raw reads.
How should Event ID 9 be investigated?
Validate Image and Device and join ProcessGuid to Event 1 for command-line and user context.
Sources
- 9: RawAccessRead
Microsoft Sysinternals · vendor
- Direct Volume Access (T1006)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule