T1680 — Local Storage Discovery

Tactic: Discovery · Platforms: ESXi, IaaS, Linux, macOS, Windows

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access. On ESXi systems, adversaries…

Sigma detection rules (4)

T1680 Local Storage Discovery

title: T1680 Local Storage Discovery
id: ca9ac0f4-b290-438e-8972-20933ecb9806
description: 'Local Storage Discovery via Drive/Volume Enumeration. Detects use of wmic logicaldisk, PowerShell Get-PSDrive, or fsutil to enumerate local drives, disks, or volumes and their free/total space -- reconnaissance commonly performed ahead of ransomware encryption or lateral movement. Tune using: user_context, parent_process_name.'
references:
  - https://attack.mitre.org/techniques/T1680
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.discovery
  - attack.t1680

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'logicaldisk'
      - 'get'
  selection_psdrive:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains: 'Get-PSDrive'
  selection_fsutil:
    Image|endswith: '\fsutil.exe'
    CommandLine|contains:
      - 'fsinfo drives'
      - 'volume list'

  condition: 1 of selection_*

falsepositives:
  - Legitimate storage-inventory/monitoring scripts, backup-software pre-checks, and IT helpdesk troubleshooting routinely enumerate drives this way; recommend pairing with parent-process/user-context tuning rather than using standalone.

level: low

T1680 Local Storage Discovery

title: T1680 Local Storage Discovery
id: be7985c8-dbec-4500-968d-2d60f0a95c10
description: 'Local Storage Discovery via Drive Enumeration and Filesystem Probing. (Retargeted from an unrelated PTY-upgrade/reverse-shell signature to the actual Linux disk/volume enumeration utilities the technique describes.) Tune using: TimeWindow, parent process context.'
references:
  - https://attack.mitre.org/techniques/T1680
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.discovery
  - attack.t1680

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/parted'
      - '/lsblk'
      - '/fdisk'
      - '/lshw'
      - '/df'
      - '/blkid'
  condition: selection

falsepositives:
  - parted, lsblk, fdisk, lshw, df, and blkid are routinely invoked by monitoring agents, backup scripts, cloud-init, and normal sysadmin disk-usage checks; this is a common, low-fidelity discovery signal best used alongside other TTPs.

level: low

T1680 Local Storage Discovery

title: T1680 Local Storage Discovery
id: fa419da2-1dba-4975-a110-371d6c1f6a0d
description: 'Local Storage Discovery via Drive Enumeration and Filesystem Probing. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: launch_agent_context, volume_name_filter.'
references:
  - https://attack.mitre.org/techniques/T1680
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.discovery
  - attack.t1680

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ditto'
      - '/cp'
    CommandLine|contains|all:
      - '/Volumes/'
      - '/Applications/'

  condition: selection

falsepositives:
  - Standard drag-and-drop installation of a legitimate application from a mounted disk image into the Applications folder produces this identical pattern, making it a very high-volume, low-precision signal on its own.

level: high

T1680 Local Storage Discovery

title: T1680 Local Storage Discovery
id: 8004662b-77ca-4270-90c1-6ad7053a96e8
description: 'Local Storage Discovery via Drive Enumeration and Filesystem Probing. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ssh_source_ip, esxcli_command_scope.'
references:
  - https://attack.mitre.org/techniques/T1680
author: Shahrukh Khan
date: 2026-04-30
license: MIT
tags:
  - attack.discovery
  - attack.t1680

logsource:
  category: process_creation
  product: esxi

detection:
  selection:
    CommandLine|contains:
      - 'esxcli storage core device list'
      - 'esxcli storage filesystem list'
      - 'esxcli storage vmfs extent list'

  condition: selection

falsepositives:
  - Standard storage administration and monitoring scripts run these commands regularly; noise reduction depends on correlating the ssh_source_ip against known jump hosts and scoping esxcli_command_scope to unexpected accounts.

level: informational

Explore