AN1271
Analytic 1271
Windows
Anomalous creation or mounting of hidden partitions or virtual file systems. Defender view: detection of registry modifications linked to non-standard file systems, suspicious disk I/O patterns, or bootkit-like behavior where hidden volumes are accessed outside normal file system APIs.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=13, 14
etw:Microsoft-Windows-Kernel-Storage
Raw disk I/O operations bypassing NTFS APIs
[MonitoredRegistryKeys]
Specify registry paths for mount points and hidden partition configs.
[DiskIOThreshold]
Tune thresholds for raw disk access outside expected drivers.
[TimeWindow]
Correlate boot-time anomalies with hidden file system mounting activity.
AN1272
Analytic 1272
Linux
Unusual mounting of loopback or pseudo file systems not aligned with legitimate administrative activity. Defender view: monitoring auditd and syslog for mount commands involving suspicious mount points, reserved blocks, or device mappings indicative of hidden partitions.
auditd:SYSCALL
mount or losetup commands creating hidden or encrypted FS
linux:syslog
Sudo or root escalation followed by filesystem mount commands
[AllowedMountPoints]
Whitelist standard mount points to reduce false positives.
[UserContext]
Flag root escalation during mount operations.
AN1273
Analytic 1273
macOS
Hidden file system use through APFS containers or custom plist configuration. Defender view: anomalous use of hdiutil or diskutil to attach hidden partitions, modification of plist entries tied to system volumes, or suspicious raw disk access.
macos:unifiedlog
Execution of diskutil or hdiutil attaching hidden partitions
macos:unifiedlog
Hidden volume attachment or modification events
[MonitoredPlistPaths]
Adjust to target only relevant plist files linked to volume mounting.
[ProcessScope]
Restrict monitoring to sensitive processes like diskutil and hdiutil.