Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access. On ESXi systems, adversaries may use Hypervisor CLI commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.12 On Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.34 Linux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.567
- TrendMicro
- TrendMicro ESXI Ransomware
- Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024
- Volexity
- AWS docs describe volumes
- GCP gcloud compute disks list
- azure az disk
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0142 | Confucius | — |
| grp_g0114 | Chimera | China |
| grp_g0126 | Higaisa | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0081 | Tropic Trooper | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0139 | TeamTNT | — |
| grp_g1022 | ToddyCat | — |
| grp_g0040 | Patchwork | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.