Local Storage Discovery T1680
Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access. On ESXi systems, adversaries…
- Tactics
- Discovery
- Actors using it
- 10
- Sub-techniques
- 0
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- ChimeraChina · 49 techniques
- TeamTNT43 techniques
- Tropic TrooperPirate Panda, KeyBoy · 35 techniques
- PatchworkHangover Group, Dropping Elephant, Chinastrats · 34 techniques
- HigaisaSouth Korea · 24 techniques
- ToddyCat24 techniques
- ConfuciusConfucius APT · 16 techniques