Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1680_local-storage-discovery
Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
Passed 25 of 26 test cases with the skill, and 19 of 26 without it.
and 8 more in the full report
6 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
During a threat hunting review for storage enumeration, how many formal detection strategies are defined for local storage discovery, and what is the exact title of the primary detection strategy?
| Checked | Without skill | With skill |
|---|---|---|
| States that exactly 1 detection strategy is documented | Missed | Passed |
| Names the detection strategy Local Storage Discovery via Drive Enumeration and Filesystem Probing | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.
On ESXi systems, adversaries may use Hypervisor CLI commands such as esxcli to list storage connected to the host as well as .vmdk files.
On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.
Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.
Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.
Platforms: ESXi, IaaS, Linux, macOS, Windows
Identify Attack Surface: Determine if the target environment is susceptible to Local Storage Discovery by examining the target platforms (ESXi, IaaS, Linux).
Assess Existing Defenses: Review whether mitigations for T1680 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 19 / 26 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.