Description
Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.
On ESXi systems, adversaries may use Hypervisor CLI commands such as esxcli to list storage connected to the host as well as .vmdk files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware)
On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity)
Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.
Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)
Platforms
Threat Groups (10)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has enumerated drives.(Citation: Talos Kimsuky Nov 2021)(Citation: Securelist Kimsuky Sept 2013)(Cita... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has discovered file system types, drive names, size, and free space on compromised systems.(Cita... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) enumerated all available drives on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: T... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has searched for disk partition and logical volume information.(Citation: ATT TeamTNT Chimaera Septem... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) collected the system volume serial number.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes ... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has detected a target system’s system volume information.(Citation: TrendMicro TropicTrooper 2... |
| G0142 | Confucius | [Confucius](https://attack.mitre.org/groups/G0142) has used a file stealer that can examine system drives, including those other than the C drive.(Cit... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information inc... |
| G1022 | ToddyCat | [ToddyCat](https://attack.mitre.org/groups/G1022) has collected information on bootable drives including model, vendor, and serial numbers.(Citation: ... |
| G0032 | Lazarus Group | A Destover-like variant used by [Lazarus Group](https://attack.mitre.org/groups/G0032) collects disk space information and sends it to its C2 server.(... |
Associated Software (88)
| ID | Name | Type | Context |
|---|---|---|---|
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has collected disk information, including type and free space available.(Citation: US-CERT BLIN... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can obtain information on physical drives from targeted hosts.(Citation: Kaspersky ToddyCat June 2022... |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) collects volume information for all drives on the system.(Citation: McAfee GhostSecret) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can gather information on drives on the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) gathers the the serial number of the main disk volume.(Citation: ASERT Donot March 2018) |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can discover logical drive information on compromised hosts.(Citation: Mandiant Suspected Turla C... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to collect the C:\ drive serial number from a compromised machine.(Citation: Bitde... |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) has the capability to collect information on disk devices.(Citation: US-CERT KEYMARBLE Aug 2018) |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) gathers disk type and disk free space.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2... |
| S1089 | SharpDisco | Malware | [SharpDisco](https://attack.mitre.org/software/S1089) can use a plugin to enumerate system drives.(Citation: MoustachedBouncer ESET August 2023) |
| S0491 | StrongPity | Malware | [StrongPity](https://attack.mitre.org/software/S0491) can identify the hard disk volume serial number on a compromised host.(Citation: Talos Promethiu... |
| S0630 | Nebulae | Malware | [Nebulae](https://attack.mitre.org/software/S0630) can discover logical drive information including the drive type, free space, and volume information... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FRO... |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has enumerated logical drives on infected hosts.(Citation: Security Scorecard Medusa Rans... |
| S1048 | macOS.OSAMiner | Malware | [macOS.OSAMiner](https://attack.mitre.org/software/S1048) has checked to ensure there is enough disk space using the Unix utility `df`.(Citation: Sent... |
| S0456 | Aria-body | Malware | [Aria-body](https://attack.mitre.org/software/S0456) has the ability to identify disk information on a compromised host.(Citation: CheckPoint Naikon M... |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) contains a command to collect disk drive information.(Citation: Proofpoint Operation Transparent Tr... |
| S9038 | DynoWiper | Malware | [DynoWiper](https://attack.mitre.org/software/S9038) has used the Microsoft Windows native `GetLogicalDrives()` and `GetDriveType()` functions to enum... |
| S0473 | Avenger | Malware | [Avenger](https://attack.mitre.org/software/S0473) has the ability to identify the host volume ID.(Citation: Trend Micro Tick November 2019) |
References
- Ankur Saini, Charlie Gardner. (2023, June 28). Charming Kitten Updates POWERSTAR with an InterPlanetary Twist. Retrieved September 25, 2025.
- AWS. (n.d.). describe-volumes. Retrieved October 20, 2025.
- Azure. (n.d.). az disk. Retrieved October 20, 2025.
- Google Cloud. (n.d.). gcloud compute disks list. Retrieved October 20, 2025.
- Junestherry Dela Cruz. (2022, January 24). Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant. Retrieved March 26, 2025.
- Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.
- Mina Naiim. (2021, May 28). DarkSide on Linux: Virtual Machines Targeted. Retrieved March 26, 2025.
Frequently Asked Questions
What is T1680 (Local Storage Discovery)?
T1680 is a MITRE ATT&CK technique named 'Local Storage Discovery'. It belongs to the Discovery tactic(s). Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to...
How can T1680 be detected?
Detection of T1680 (Local Storage Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1680?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1680?
Known threat groups using T1680 include: Kimsuky, Volt Typhoon, Patchwork, TeamTNT, Higaisa, Tropic Trooper, Confucius, Chimera.