tfMITRE ATT&CK technique

Local Storage Discovery T1680

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.0
Created: 25 September 2025
Last modified: 12 May 2026
Contributor: Liran Ravich, CardinalOps

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 19%

Threat groups81st percentile · 81% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Local Storage Discovery MITRE reference T1680

Top 19%of all ATT&CK techniques for number of groups

10 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ToddyCatG1022 ↗

Has collected information on bootable drives including model, vendor, and serial numbers.1

created 2024-01-031 reference

Volt TyphoonG1017 ↗

Has discovered file system types, drive names, size, and free space on compromised systems.1 2 3 4

created 2023-07-274 referencesaka BRONZE SILHOUETTE

ConfuciusG0142 ↗

Has used a file stealer that can examine system drives, including those other than the C drive.1

created 2021-12-261 referenceaka Confucius APT

TeamTNTG0139 ↗

Has searched for disk partition and logical volume information.1 2

created 2021-10-012 references

HigaisaG0126 ↗

Collected the system volume serial number.1 2

created 2021-03-052 references

ChimeraG0114 ↗

Has used fsutil fsinfo drives, systeminfo, and vssadmin list shadows for system information including shadow volumes and drive information.1

created 2020-08-241 reference

All 10 groups for this technique · 6 newest in this preview

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0017C0017 ↗

During C0017, APT41 issued ping -n 1 ((cmd /c dir c:\|findstr Number).split()[-1]+ commands to find the volume serial number of compromised systems.1

2021–2022

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used fsutil to check available free space before executing actions that might create large files on disk.1

2019–2021

Operation WocaoC0014 ↗

During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model.1

2017–2019

All 3 campaigns for this technique

88 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DynoWiperS9038 ↗

Has used the Microsoft Windows native GetLogicalDrives() and GetDriveType() functions to enumerate all the drives visible to the system.1

created 2026-04-22MALWARE

AshTagS9031 ↗

Can use volumeserialnumber to enumerate volumes.1

created 2026-04-20MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has enumerated logical drives on infected hosts.1

created 2025-10-17MALWAREcarried by 1 group

QilinS1242 ↗

Has used GetLogicalDrives() and EnumResourceW() to locate mounted drives and shares.1

created 2025-09-26MALWAREcarried by 2 groups

TONESHELLS1239 ↗

Has retrieved the disk serial number of the device using WMI query SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C: to identify the victim machine.1

created 2025-09-15MALWAREcarried by 1 group

PUBLOADS1228 ↗

Has leveraged wmic logicaldisk get to map local network drives.1

created 2025-08-04MALWAREcarried by 1 group

All 88 software entries for this technique · 6 newest in this preview

Offense vs defense T1680

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Local Storage Discovery detection strategy DET0188

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Local Storage Discovery via Drive Enumeration and Filesystem Probing

Enterprise

4 platforms

AN0536 · Windows

Drive enumeration using PowerShell (Get-PSDrive), wmic logicaldisk, or Win32 API indicative of local volume enumeration by non-admin users or executed outside of baseline system inventory scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
user_context	Non-system accounts performing drive enumeration may be higher fidelity indicators
parent_process_name	Baseline parent-child process lineage can help distinguish admin tools from malicious scripts

AN0537 · Linux

Abnormal use of lsblk, fdisk -l, lshw -class disk, or parted by non-admin users or within non-interactive shells suggests suspicious disk enumeration activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)
Command ExecutionDC0064	auditd:EXECVE	command line arguments containing lsblk, fdisk, parted

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TTY_type	Detection can exclude interactive TTY sessions to reduce false positives from admin usage
shell_parent	Differentiate between interactive user shells vs. script-based execution

AN0538 · macOS

Disk enumeration via diskutil list or system_profiler SPStorageDataType run outside of user login or not associated with system inventory tools

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process launch of diskutil or system_profiler with SPStorageDataType
Command ExecutionDC0064	macos:unifiedlog	log messages related to disk enumeration context or Terminal session

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
launch_agent_context	Unexpected use of disk enumeration tools from GUI apps or LaunchAgents may indicate abuse
volume_name_filter	Filter known baseline volume names or identifiers used by common device configurations

AN0539 · ESXi

Use of esxcli storage or vim-cmd vmsvc/getallvms by unusual sessions or through interactive shells unrelated to administrative maintenance tasks.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	esxi:auth	interactive shell or SSH access preceding storage enumeration
Process CreationDC0032	esxi:hostd	execution of esxcli with args matching 'storage', 'filesystem', 'core device list'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ssh_source_ip	Restrict alerts to unexpected remote sessions accessing host storage commands
esxcli_command_scope	Tailor detection based on subcommands more likely to be abused

Tests2ExecutorsPowerShell 1 · cmd 1Need elevation0 of 2Have prerequisites0Have cleanup0Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Local Storage Discovery via PSDrive	windows	PowerShell	—	—	—
Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system. Attack command Get-PSDrive -PSProvider FileSystem Get-Volume GUID7c1f0e58-6b28-48f5-a14a-4111fc4edc37
02	Local Storage Discovery via wmic	windows	cmd	—	—	—
Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system. Attack command wmic logicaldisk get deviceid, freespace, size, volumeserialnumber GUID35aba8ef-a112-4187-8c2f-864c66f9b86f

Tests from Atomic Red Team (MIT licence) · technique definition

Local Storage Discovery detections T1680

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs