Potential Defense Evasion Via Raw Disk Access By Uncommon Tools — Detection Rule
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts