MITRE ATT&CKtechnique

T1680 Local Storage Discovery

Published 2025-09-25 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, IaaS, Linux, macOS, Windows
Version
1.0
Created
2025-09-25

Description

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access. On ESXi systems, adversaries may use Hypervisor CLI commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files. On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`. Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (103)

  • S9052 MiniFast software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9038 DynoWiper software (malware)
  • S9031 AshTag software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1228 PUBLOAD software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1168 SampleCheck5000 software (malware)
  • S1150 ROADSWEEP software (malware)
  • S1151 ZeroCleare software (malware)
  • S1147 Nightdoor software (malware)
  • S1139 INC Ransomware software (malware)
  • S1111 DarkGate software (malware)
  • S1100 Ninja software (malware)
  • G1022 ToddyCat group
  • S1089 SharpDisco software (malware)
  • S1087 AsyncRAT software (tool)
  • S1085 Sardonic software (malware)
  • G1017 Volt Typhoon group
  • S1075 KOPILUWAK software (malware)
  • S1073 Royal software (malware)
  • C0024 SolarWinds Compromise campaign
  • S1070 Black Basta software (malware)
  • S1068 BlackCat software (malware)
  • S1065 Woody RAT software (malware)
  • S1060 Mafalda software (malware)
  • C0017 C0017 campaign
Show all 103 ›

References