Sysmon Event ID 9


9: RawAccessRead

This is an event from Sysmon.

On this page

The RawAccessRead event detects when a process conducts reading operations from the drive using the \\.\ denotation. This technique is often used by malware for data exfiltration of files that are locked for reading, as well as to avoid file access auditing tools. The event indicates the source process and target device.

This event can help you detect theft of ntds.dit which is a file located on your Domain Controllers.  This file contains the hashes from your AD Domain. 

For more information on ntds.dit and protecting it you can view this webinar, "Three Modern Active Directory Attack Scenarios and How to Detect Them".

Free Security Log Resources by Randy

Description Fields in 9

  • Log Name
  • Source
  • Date
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • Description
  • RawAccessRead
  • UtcTime: Time event occurred
  • ProcessGuid:  The GUID of the process that generated the event
  • ProcessID: ID of the process that generated the event
  • Image: File used to generate the event
  • Device

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.



Examples of 9

Log Name:      Microsoft-Windows-Sysmon/Operational
Source:        Microsoft-Windows-Sysmon
Date:          3/22/2018 1:32:22 PM
Event ID:      9
Task Category: RawAccessRead detected (rule: RawAccessRead)
Level:         Information
User:          SYSTEM
Computer:      rfsH.lab.local
RawAccessRead detected:
UtcTime: 2018-03-22 20:32:22.332
ProcessGuid: {a23eae89-c65f-5ab2-0000-0010eb030000}
ProcessId: 4
Image: System
Device: \Device\HarddiskVolume2
Event Xml:
<Event xmlns="">
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
    <TimeCreated SystemTime="2018-03-22T20:32:22.333778700Z" />
    <Correlation />
    <Execution ProcessID="19572" ThreadID="21888" />
    <Security UserID="S-1-5-18" />
    <Data Name="UtcTime">2018-03-22 20:32:22.332</Data>
    <Data Name="ProcessGuid">{A23EAE89-C65F-5AB2-0000-0010EB030000}</Data>
    <Data Name="ProcessId">4</Data>
    <Data Name="Image">System</Data>
    <Data Name="Device">\Device\HarddiskVolume2</Data>


Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources