tfMITRE ATT&CK technique

Local Storage Discovery T1680

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.0
Created: 25 September 2025
Last modified: 12 May 2026
Contributor: Liran Ravich, CardinalOps

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 80% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

tfMITRE ATT&CK technique

Local Storage Discovery T1680

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.0
Created: 25 September 2025
Last modified: 12 May 2026
Contributor: Liran Ravich, CardinalOps

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 80% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 12%

Campaigns88th percentile · 83% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have fewer tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Local Storage Discovery MITRE reference T1680

Top 19%of all ATT&CK techniques for number of groups

10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ToddyCatG1022 ↗

Has collected information on bootable drives including model, vendor, and serial numbers.1

created 2024-01-031 reference

Volt TyphoonG1017 ↗

Has discovered file system types, drive names, size, and free space on compromised systems.1 2 3 4

created 2023-07-274 referencesaka BRONZE SILHOUETTE

ConfuciusG0142 ↗

Has used a file stealer that can examine system drives, including those other than the C drive.1

created 2021-12-261 referenceaka Confucius APT

TeamTNTG0139 ↗

Has searched for disk partition and logical volume information.1 2

created 2021-10-012 references

HigaisaG0126 ↗

Collected the system volume serial number.1 2

created 2021-03-052 references

ChimeraG0114 ↗

Has used fsutil fsinfo drives, systeminfo, and vssadmin list shadows for system information including shadow volumes and drive information.1

created 2020-08-241 reference

All 10 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0017C0017 ↗

During C0017, APT41 issued ping -n 1 ((cmd /c dir c:\|findstr Number).split()[-1]+ commands to find the volume serial number of compromised systems.1

2021–2022

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used fsutil to check available free space before executing actions that might create large files on disk.1

2019–2021

Operation WocaoC0014 ↗

During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model.1

2017–2019

All 3 campaigns for this technique

88 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DynoWiperS9038 ↗

Has used the Microsoft Windows native GetLogicalDrives() and GetDriveType() functions to enumerate all the drives visible to the system.1

created 2026-04-22MALWARE

AshTagS9031 ↗

Can use volumeserialnumber to enumerate volumes.1

created 2026-04-20MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has enumerated logical drives on infected hosts.1

created 2025-10-17MALWAREcarried by 1 group

QilinS1242 ↗

Has used GetLogicalDrives() and EnumResourceW() to locate mounted drives and shares.1

created 2025-09-26MALWAREcarried by 2 groups

TONESHELLS1239 ↗

Has retrieved the disk serial number of the device using WMI query SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C: to identify the victim machine.1

created 2025-09-15MALWAREcarried by 1 group

PUBLOADS1228 ↗

Has leveraged wmic logicaldisk get to map local network drives.1

created 2025-08-04MALWAREcarried by 1 group

All 88 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Field	What you tune
user_context	Non-system accounts performing drive enumeration may be higher fidelity indicators
parent_process_name	Baseline parent-child process lineage can help distinguish admin tools from malicious scripts

Field

What you tune

user_context

Non-system accounts performing drive enumeration may be higher fidelity indicators

parent_process_name

Baseline parent-child process lineage can help distinguish admin tools from malicious scripts

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)
Command ExecutionDC0064	auditd:EXECVE	command line arguments containing lsblk, fdisk, parted

Data component

Name

Channel

Process CreationDC0032

auditd:SYSCALL

execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)

Command ExecutionDC0064

auditd:EXECVE

command line arguments containing lsblk, fdisk, parted

Field	What you tune
TTY_type	Detection can exclude interactive TTY sessions to reduce false positives from admin usage
shell_parent	Differentiate between interactive user shells vs. script-based execution

Field

What you tune

TTY_type

Detection can exclude interactive TTY sessions to reduce false positives from admin usage

shell_parent

Differentiate between interactive user shells vs. script-based execution

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process launch of diskutil or system_profiler with SPStorageDataType
Command ExecutionDC0064	macos:unifiedlog	log messages related to disk enumeration context or Terminal session

Data component

Name

Channel

Process CreationDC0032

macos:unifiedlog

process launch of diskutil or system_profiler with SPStorageDataType

Command ExecutionDC0064

macos:unifiedlog

log messages related to disk enumeration context or Terminal session

Field	What you tune
launch_agent_context	Unexpected use of disk enumeration tools from GUI apps or LaunchAgents may indicate abuse
volume_name_filter	Filter known baseline volume names or identifiers used by common device configurations

Field

What you tune

launch_agent_context

Unexpected use of disk enumeration tools from GUI apps or LaunchAgents may indicate abuse

volume_name_filter

Filter known baseline volume names or identifiers used by common device configurations

Data component	Name	Channel
User Account AuthenticationDC0002	esxi:auth	interactive shell or SSH access preceding storage enumeration
Process CreationDC0032	esxi:hostd	execution of esxcli with args matching 'storage', 'filesystem', 'core device list'

Data component

Name

Channel

User Account AuthenticationDC0002

esxi:auth

interactive shell or SSH access preceding storage enumeration

Process CreationDC0032

esxi:hostd

execution of esxcli with args matching 'storage', 'filesystem', 'core device list'

Field	What you tune
ssh_source_ip	Restrict alerts to unexpected remote sessions accessing host storage commands
esxcli_command_scope	Tailor detection based on subcommands more likely to be abused

Field

What you tune

ssh_source_ip

Restrict alerts to unexpected remote sessions accessing host storage commands

esxcli_command_scope

Tailor detection based on subcommands more likely to be abused

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Local Storage Discovery via PSDrive	windows	powershell	—	—	—
Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system. Attack Commandsrun with `powershell` Get-PSDrive -PSProvider FileSystem Get-Volume GUID3a4d51bd-b0f5-4249-821c-ba8997c42c00
02	Local Storage Discovery via wmic	windows	command_prompt	—	—	—
Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system. Attack Commandsrun with `command_prompt` wmic logicaldisk get deviceid, freespace, size, volumeserialnumber GUID1c11a623-e783-4b2f-ad4a-0a62591e8f85

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Local Storage Discovery via PSDrive

windows

powershell

—

Local Storage Discovery via wmic

windows

command_prompt

—

Local Storage Discovery T1680

Local Storage Discovery T1680

Local Storage Discovery MITRE reference T1680

Local Storage Discovery MITRE reference T1680

Offense vs defense T1680

Local Storage Discovery detection strategy DET0188

Local Storage Discovery via Drive Enumeration and Filesystem Probing

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Local Storage Discovery detections T1680

Local Storage Discovery detections T1680