T1680

Description from ATT&CK

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.

On ESXi systems, adversaries may use Hypervisor CLI commands such as esxcli to list storage connected to the host as well as .vmdk files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware)

On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity)

Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.

Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)

Source

Atomic Tests

• Atomic Test #1: Local Storage Discovery via PSDrive
• Atomic Test #2: Local Storage Discovery via wmic

Atomic Test #1: Local Storage Discovery via PSDrive

Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system.

Supported Platforms: Windows

auto_generated_guid: 3a4d51bd-b0f5-4249-821c-ba8997c42c00

Attack Commands: Run with powershell!

Get-PSDrive -PSProvider FileSystem
Get-Volume

Atomic Test #2: Local Storage Discovery via wmic

Will enumerate logical drives and file system details using the "Get-PSDrive" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system.

Supported Platforms: Windows

auto_generated_guid: 1c11a623-e783-4b2f-ad4a-0a62591e8f85

Attack Commands: Run with command_prompt!

wmic logicaldisk get deviceid, freespace, size, volumeserialnumber

Atomic test(s) for this technique last updated: 2026-07-13 15:34:32 UTC