Hackers Exploit Raw Disk Reads to Evade EDR and Steal Sensitive Files

Hackers are shown bypassing Endpoint Detection and Response (EDR) tools by reading raw disk sectors instead of using normal file APIs, allowing them to steal sensitive files such as the SAM hive, SYSTEM hive, and NTDS[.]dit without triggering typical alerts. In a Windows environment, drivers provide low‑level access to disk functions, and a recent investigation by Workday’s Offensive Security team uncovered that a default or vulnerable driver can be abused to perform these raw reads.

The technique hinges on a vulnerable driver named eudskacs.sys (CVE-2025-50892), which exposes a simple interface for raw disk reads and forwards requests down the Windows driver stack to read actual disk sectors. By parsing the NTFS file system, attackers can locate partitions, read the MFT, decode data runs and obtain file contents, all while evading ACLs, exclusive file locks, VBS and Credential Guard, and most EDR hooks.

Defences include auditing drivers, enforcing strict SDDL, monitoring sector reads, and hardening privileges to restrict access to disk.sys. September 5, 2025. according to Workday’s Offensive Security team.