Techniques › T1680
T1680 Local Storage Discovery
discovery — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1680
0
KEV CVEs mapped here
<p>Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.</p><p>On ESXi systems, adversaries may use Hypervisor CLI commands such as
esxcli to list storage connected to the host as well as .vmdk files.</p><p>On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.</p><p>Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.</p><p>Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0188 Local Storage Discovery via Drive Enumeration and Filesystem Probing v1.0
AN0536 WindowsDrive enumeration using PowerShell (
Get-PSDrive),wmic logicaldisk, or Win32 API indicative of local volume enumeration by non-admin users or executed outside of baseline system inventory scripts.Tunable:user_contextparent_process_nameAN0537 LinuxAbnormal use oflsblk,fdisk -l,lshw -class disk, orpartedby non-admin users or within non-interactive shells suggests suspicious disk enumeration activity.auditd:SYSCALLexecve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)→ DC0032 Process CreationTunable:TTY_typeshell_parentAN0538 macOSDisk enumeration viadiskutil listorsystem_profiler SPStorageDataTyperun outside of user login or not associated with system inventory toolsmacos:unifiedlogprocess launch of diskutil or system_profiler with SPStorageDataType→ DC0032 Process Creationmacos:unifiedloglog messages related to disk enumeration context or Terminal session→ DC0064 Command ExecutionTunable:launch_agent_contextvolume_name_filterAN0539 ESXiUse ofesxcli storageorvim-cmd vmsvc/getallvmsby unusual sessions or through interactive shells unrelated to administrative maintenance tasks.esxi:hostdexecution of esxcli with args matching 'storage', 'filesystem', 'core device list'→ DC0032 Process Creationesxi:authinteractive shell or SSH access preceding storage enumeration→ DC0002 User Account AuthenticationTunable:ssh_source_ipesxcli_command_scope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1680
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.