cyberstrikeus T1680 Local Storage Discovery
High-Level Description
Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.
On ESXi systems, adversaries may use Hypervisor CLI commands such as esxcli to list storage connected to the host as well as .vmdk files.
On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.
Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.
Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.
Kill Chain Phase
- Discovery (TA0007)
Platforms: ESXi, IaaS, Linux, macOS, Windows
What to Check
- Identify if Local Storage Discovery technique is applicable to target environment
- Check ESXi systems for indicators of Local Storage Discovery
- Check IaaS systems for indicators of Local Storage Discovery
- Check Linux systems for indicators of Local Storage Discovery
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Local Storage Discovery by examining the target platforms (ESXi, IaaS, Linux).
Assess Existing Defenses: Review whether mitigations for T1680 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Local Storage Discovery via Drive Enumeration and Filesystem Probing
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Local Storage Discovery technique applicable | Medium | Discovery |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |