{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1680","id":"T1680","name":"Local Storage Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1680","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"5f5c6603df4a325d0f446a37a7154a97b2ad746bd3405619105ef4e65e0896cd","description":"Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). \n\nOn ESXi systems, adversaries may use [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) commands such as `esxcli` to list storage connected to the host as well as `.vmdk` files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware)\n\nOn Windows systems, adversaries can use `wmic logicaldisk get` to find information about local network drives. They can also use `Get-PSDrive` in PowerShell to retrieve drives and may additionally use Windows API functions such as `GetDriveType`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity)\n\nLinux has commands such as `parted`, `lsblk`, `fdisk`, `lshw`, and `df` that can list information about disk partitions such as size, type, file system types, and free space. The command `diskutil` on MacOS can be used to list disks while `system_profiler SPStorageDataType` can additionally show information such as a volume’s mount path, file system, and the type of drive in the system. \n\nInfrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as `describe volume` in AWS, `gcloud compute disks list` in GCP, and `az disk list` in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1680","external_id":"T1680"},{"source_name":"Volexity","description":"Ankur Saini, Charlie Gardner. (2023, June 28). Charming Kitten Updates POWERSTAR with an InterPlanetary Twist. Retrieved September 25, 2025.","url":"https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/"},{"source_name":"AWS docs describe volumes","description":"AWS. (n.d.). describe-volumes. Retrieved October 20, 2025.","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"},{"source_name":"azure az disk","description":"Azure. (n.d.). az disk. Retrieved October 20, 2025.","url":"https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest"},{"source_name":"GCP gcloud compute disks list","description":"Google Cloud. (n.d.). gcloud compute disks list. Retrieved October 20, 2025.","url":"https://cloud.google.com/sdk/gcloud/reference/compute/disks/list"},{"source_name":"TrendMicro ESXI Ransomware","description":"Junestherry Dela Cruz. (2022, January 24). Analysis and Impact of LockBit Ransomware’s First Linux and VMware ESXi Variant. Retrieved March 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"TrendMicro","description":"Mina Naiim. (2021, May 28). DarkSide on Linux: Virtual Machines Targeted. Retrieved March 26, 2025.","url":"https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html"}],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1680","id":"T1680","name":"Local Storage Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1680","technique_page":"techniques/enterprise/T1680/","page":"detections/enterprise/T1680/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0188","name":"Local Storage Discovery via Drive Enumeration and Filesystem Probing","url":"https://attack.mitre.org/detectionstrategies/DET0188","stix_id":"x-mitre-detection-strategy--8c3d7757-f3ab-4c1d-95e1-f712cdecd5a3","relationship_id":"relationship--3dc43a6d-8862-4a4f-92c4-b3776539a19b","description":"","analytics":[{"id":"AN0536","name":"Analytic 0536","guidance":"Drive enumeration using PowerShell (`Get-PSDrive`), `wmic logicaldisk`, or Win32 API indicative of local volume enumeration by non-admin users or executed outside of baseline system inventory scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0536","platforms":["Windows"],"tuning":[{"field":"user_context","description":"Non-system accounts performing drive enumeration may be higher fidelity indicators"},{"field":"parent_process_name","description":"Baseline parent-child process lineage can help distinguish admin tools from malicious scripts"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0536","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0536","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0537","name":"Analytic 0537","guidance":"Abnormal use of `lsblk`, `fdisk -l`, `lshw -class disk`, or `parted` by non-admin users or within non-interactive shells suggests suspicious disk enumeration activity.","url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0537","platforms":["Linux"],"tuning":[{"field":"TTY_type","description":"Detection can exclude interactive TTY sessions to reduce false positives from admin usage"},{"field":"shell_parent","description":"Differentiate between interactive user shells vs. script-based execution"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)","platforms":["Linux"],"analytic_id":"AN0537","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0537","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:EXECVE","channel":"command line arguments containing lsblk, fdisk, parted","platforms":["Linux"],"analytic_id":"AN0537","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0537","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0538","name":"Analytic 0538","guidance":"Disk enumeration via `diskutil list` or `system_profiler SPStorageDataType` run outside of user login or not associated with system inventory tools","url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0538","platforms":["macOS"],"tuning":[{"field":"launch_agent_context","description":"Unexpected use of disk enumeration tools from GUI apps or LaunchAgents may indicate abuse"},{"field":"volume_name_filter","description":"Filter known baseline volume names or identifiers used by common device configurations"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process launch of diskutil or system_profiler with SPStorageDataType","platforms":["macOS"],"analytic_id":"AN0538","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0538","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"log messages related to disk enumeration context or Terminal session","platforms":["macOS"],"analytic_id":"AN0538","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0538","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0539","name":"Analytic 0539","guidance":"Use of `esxcli storage` or `vim-cmd vmsvc/getallvms` by unusual sessions or through interactive shells unrelated to administrative maintenance tasks.","url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0539","platforms":["ESXi"],"tuning":[{"field":"ssh_source_ip","description":"Restrict alerts to unexpected remote sessions accessing host storage commands"},{"field":"esxcli_command_scope","description":"Tailor detection based on subcommands more likely to be abused"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"esxi:hostd","channel":"execution of esxcli with args matching 'storage', 'filesystem', 'core device list'","platforms":["ESXi"],"analytic_id":"AN0539","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0539","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0002","component":"User Account Authentication","name":"esxi:auth","channel":"interactive shell or SSH access preceding storage enumeration","platforms":["ESXi"],"analytic_id":"AN0539","source_url":"https://attack.mitre.org/detectionstrategies/DET0188#AN0539","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has collected a list of all mapped drives on the infected host.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--30437ed1-5cad-4656-9ae8-c4a06122b613","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"[JHUHUGIT](https://attack.mitre.org/software/S0044) obtains a build identifier as well as victim hard drive information from Windows registry key <code>HKLM\\SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum</code>. Another [JHUHUGIT](https://attack.mitre.org/software/S0044) variant gathers the victim storage volume serial number and the storage device name.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)","relationship_id":"relationship--e11d4f32-842a-4684-8974-f368e52b8632","references":[{"source_name":"ESET Sednit Part 1","description":"ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"Unit 42 Sofacy Feb 2018","description":"Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) collects disk space information.(Citation: Kaspersky Turla Aug 2014)","relationship_id":"relationship--de99649c-2d3a-4cbc-be0c-003e399e3963","references":[{"source_name":"Kaspersky Turla Aug 2014","description":"Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) contains a command to collect disk drive information.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)","relationship_id":"relationship--fccaf542-b2ae-4814-a366-2fe6ab4c809a","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0137","name":"CORESHELL","url":"https://attack.mitre.org/software/S0137","kind":"malware","description":"[CORESHELL](https://attack.mitre.org/software/S0137) collects the volume serial number from the victim and sends the information to its C2 server.(Citation: FireEye APT28)","relationship_id":"relationship--44150544-030d-430c-bec8-6fb4373d484e","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0172","name":"Reaver","url":"https://attack.mitre.org/software/S0172","kind":"malware","description":"[Reaver](https://attack.mitre.org/software/S0172) collects volume serial number from the victim.(Citation: Palo Alto Reaver Nov 2017)","relationship_id":"relationship--cf3ec188-0f5d-4f7b-837b-1bdb79508aa6","references":[{"source_name":"Palo Alto Reaver Nov 2017","description":"Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}]},{"id":"S0181","name":"FALLCHILL","url":"https://attack.mitre.org/software/S0181","kind":"malware","description":"[FALLCHILL](https://attack.mitre.org/software/S0181) can collect information about installed disks from the victim.(Citation: US-CERT FALLCHILL Nov 2017)","relationship_id":"relationship--cca29cfc-4753-4d3e-a1c7-848a66f0a593","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}]},{"id":"S0208","name":"Pasam","url":"https://attack.mitre.org/software/S0208","kind":"malware","description":"[Pasam](https://attack.mitre.org/software/S0208) creates a backdoor through which remote attackers can retrieve information like free disk space.(Citation: Symantec Pasam May 2012)","relationship_id":"relationship--5bdc87b7-a975-4fd8-a4e3-131f769600f3","references":[{"source_name":"Symantec Pasam May 2012","description":"Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) can collect information about the drives available on the system.(Citation: CheckPoint Bandook Nov 2020) ","relationship_id":"relationship--b42354ae-384d-4885-96a0-1594ed6dd427","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) collects volume information for all drives on the system.(Citation: McAfee GhostSecret)","relationship_id":"relationship--7224a7bb-225c-484a-9481-d3a0cb328b32","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) gathers disk type and disk free space.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--d760ae68-4127-4fec-814b-020a40f7b4e5","references":[{"source_name":"McAfee Bankshot","description":"Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) gathers the the serial number of the main disk volume.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--0da384db-9a5b-4256-81b4-19df05a4ceb8","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) collects the serial number for the storage volume C:\\.(Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)","relationship_id":"relationship--912fc001-4c47-42fb-a2c0-7abed4e620b1","references":[{"source_name":"Accenture SNAKEMACKEREL Nov 2018","description":"Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"},{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"Palo Alto Sofacy 06-2018","description":"Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}]},{"id":"S0253","name":"RunningRAT","url":"https://attack.mitre.org/software/S0253","kind":"malware","description":"[RunningRAT](https://attack.mitre.org/software/S0253) gathers logical drives information and volume information.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--082a573f-d760-4bd8-a830-8c5a57b4ea44","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0259","name":"InnaputRAT","url":"https://attack.mitre.org/software/S0259","kind":"malware","description":"[InnaputRAT](https://attack.mitre.org/software/S0259) gathers volume drive information.(Citation: ASERT InnaputRAT April 2018)","relationship_id":"relationship--c4dd3873-c9e7-4453-9acb-aeb868eef874","references":[{"source_name":"ASERT InnaputRAT April 2018","description":"ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can gather information on the mapped drives and system volume serial number.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--937febf9-bb30-4fcf-a208-e599693d4588","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0263","name":"TYPEFRAME","url":"https://attack.mitre.org/software/S0263","kind":"malware","description":"[TYPEFRAME](https://attack.mitre.org/software/S0263) can gather the disk volume information.(Citation: US-CERT TYPEFRAME June 2018)","relationship_id":"relationship--d0e4c9af-070a-43bd-82e6-c047f7ebf491","references":[{"source_name":"US-CERT TYPEFRAME June 2018","description":"US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) gathers information on local drives.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--cfdffe47-f77b-46bb-8d7d-1753f5d74ff6","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) collects the victim’s volume serial number.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--3511b2ef-7012-4a7f-8b38-d6b7ba508b59","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"},{"source_name":"FireEye FELIXROOT July 2018","description":"Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) has the capability to collect information on disk devices.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--9e3f33db-5076-403b-b71e-71d898389e0b","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0340","name":"Octopus","url":"https://attack.mitre.org/software/S0340","kind":"malware","description":"[Octopus](https://attack.mitre.org/software/S0340) can collect system drive and disk size information.(Citation: Securelist Octopus Oct 2018)","relationship_id":"relationship--c8a336f0-300c-4c9a-a501-5d679f583048","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can gather drive information from the victim's machine.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)","relationship_id":"relationship--2f59d9ec-a48d-4565-a8da-1377e06dfb3f","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) can gather information on drives on the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--bea2bee1-a80c-40a0-9552-e9f49d4fe33b","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) can gather information on connected drives and disk space from the victim’s machine.(Citation: Talos Konni May 2017)(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)","relationship_id":"relationship--7b30e00a-71c6-4ad8-b2a8-39f000156930","references":[{"source_name":"Medium KONNI Jan 2020","description":"Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"},{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has been observed collecting victim machine volume information.(Citation: US-CERT HOPLIGHT Apr 2019)","relationship_id":"relationship--937f8691-2941-4365-9a82-889d3b67a641","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) monitors the free disk space on the system.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--faccd8d5-0e21-4e57-aef9-1ccf72150294","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has called <code>GetLogicalDrives</code> to emumerate all mounted drives, and <code>GetDriveTypeW</code> to determine the drive type.(Citation: CrowdStrike Ryuk January 2019)","relationship_id":"relationship--9cf32fea-16cd-41cf-93f3-a47c1388abbc","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can detect drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--f87c6571-5031-4abb-8eaf-3416eec79928","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to identify disk information on a compromised host.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--f8bf7fa5-3af6-4770-ae87-022154a9378e","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)\t","relationship_id":"relationship--81a857bb-4c36-4875-a62e-30e7b12eae12","references":[{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"},{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0471","name":"build_downer","url":"https://attack.mitre.org/software/S0471","kind":"malware","description":"[build_downer](https://attack.mitre.org/software/S0471) has the ability to send system volume information to C2.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--a6c20b07-57ea-46dd-aa71-93849b6b66ca","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0472","name":"down_new","url":"https://attack.mitre.org/software/S0472","kind":"malware","description":"[down_new](https://attack.mitre.org/software/S0472) has the ability to identify the system volume information of a compromised host.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--14de629c-9b49-4841-901a-85fab61f693b","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to identify the host volume ID.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--e0245348-fa82-4cc7-baa6-e17d1e58706a","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can enumerate the system drives and associated system name.(Citation: CME Github September 2018)","relationship_id":"relationship--c42d1cc1-3685-4bd7-96ba-84a66cc6a287","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) can identify the hard disk volume serial number on a compromised host.(Citation: Talos Promethium June 2020)","relationship_id":"relationship--a6b41bba-0b47-400d-9aa4-134b4f47994f","references":[{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can identify system drive information on a compromised host.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--b4d35a40-e89f-453f-aeab-5e44dacbc1f8","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Group IB Ransomware May 2020","description":"Group IB. (2020, May). Ransomware Uncovered: Attackers’ Latest Methods. Retrieved August 5, 2020.","url":"https://www.group-ib.com/whitepapers/ransomware-uncovered.html"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Secureworks GandCrab and REvil September 2019","description":"Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) can collect disk space information on victim machines by executing [Systeminfo](https://attack.mitre.org/software/S0096).(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--a220cf94-7165-44ed-85da-014bc684e680","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0520","name":"BLINDINGCAN","url":"https://attack.mitre.org/software/S0520","kind":"malware","description":"[BLINDINGCAN](https://attack.mitre.org/software/S0520) has collected disk information, including type and free space available.(Citation: US-CERT BLINDINGCAN Aug 2020)","relationship_id":"relationship--c80db47b-f1d6-4f62-aea0-d87edb778f5e","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","description":"US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}]},{"id":"S0526","name":"KGH_SPY","url":"https://attack.mitre.org/software/S0526","kind":"malware","description":"[KGH_SPY](https://attack.mitre.org/software/S0526) can collect drive information from a compromised host.(Citation: Cybereason Kimsuky November 2020)","relationship_id":"relationship--dd67596a-64c6-4dfb-b498-e7d5c1886090","references":[{"source_name":"Cybereason Kimsuky November 2020","description":"Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has collected disk information from a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--0160f1e4-76bd-4490-af74-bb80072cecae","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0564","name":"BlackMould","url":"https://attack.mitre.org/software/S0564","kind":"malware","description":"[BlackMould](https://attack.mitre.org/software/S0564) can enumerate local drives on a compromised host.(Citation: Microsoft GALLIUM December 2019)","relationship_id":"relationship--11917102-46c9-4c12-964c-065ad6b2a14f","references":[{"source_name":"Microsoft GALLIUM December 2019","description":"MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"[TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) can use <code>DriveList</code> to retrieve drive information.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--e1eebea8-ad12-4c3f-bbdc-10f26bbccda8","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"[Penquin](https://attack.mitre.org/software/S0587) can report the disk space of a compromised host to C2.(Citation: Leonardo Turla Penquin May 2020)","relationship_id":"relationship--77534dcc-4183-41b5-adbd-cc7e8ccaa3ec","references":[{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has discovered system information including volume serial numbers.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--d63bf9b2-d13c-4a16-b952-700594fc9f50","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) retrieves the hard disk name by calling the <code>CreateFileA to \\\\.\\PHYSICALDRIVE0</code> API.(Citation: Trend Micro KillDisk 1)","relationship_id":"relationship--22b9eb17-686a-4cfe-b9a1-cffe22c7755f","references":[{"source_name":"Trend Micro KillDisk 1","description":"Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"}]},{"id":"S0616","name":"DEATHRANSOM","url":"https://attack.mitre.org/software/S0616","kind":"malware","description":"[DEATHRANSOM](https://attack.mitre.org/software/S0616) can enumerate logical drives on a target system.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--e69dfb2f-c89b-4167-9165-4f3026b32ad7","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0617","name":"HELLOKITTY","url":"https://attack.mitre.org/software/S0617","kind":"malware","description":"[HELLOKITTY](https://attack.mitre.org/software/S0617) can enumerate logical drives on a target system.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--98c69e3a-1fc1-4da2-adc5-a33723ab1be4","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) can enumerate local drives, disk type, and disk free space.(Citation: McAfee Cuba April 2021)","relationship_id":"relationship--059a2b6f-2b77-4f71-acd4-a3c39c4c2da4","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0630","name":"Nebulae","url":"https://attack.mitre.org/software/S0630","kind":"malware","description":"[Nebulae](https://attack.mitre.org/software/S0630) can discover logical drive information including the drive type, free space, and volume information.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--22a699a2-ad75-470e-87c9-9ec8f9763e8e","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can enumerate disk volumes, get disk information, and query service status.(Citation: McAfee Babuk February 2021)","relationship_id":"relationship--e0140710-f03a-4e43-9e87-45926636b377","references":[{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can collect a system's drive information.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--19dccc7d-03eb-45a4-88c1-1ed4ddcee7a3","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) has the ability to list drives.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--4e204be0-a2f2-47e8-9b43-84cc2736784a","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0672","name":"Zox","url":"https://attack.mitre.org/software/S0672","kind":"malware","description":"[Zox](https://attack.mitre.org/software/S0672) can enumerate attached drives.(Citation: Novetta-Axiom)","relationship_id":"relationship--be4909b2-ff92-4dca-b835-09df2b10adb2","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"S0678","name":"Torisma","url":"https://attack.mitre.org/software/S0678","kind":"malware","description":"[Torisma](https://attack.mitre.org/software/S0678) can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.(Citation: McAfee Lazarus Nov 2020)","relationship_id":"relationship--0b6312e1-2601-4bb3-ba21-ee1c488b3506","references":[{"source_name":"McAfee Lazarus Nov 2020","description":"Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) has the ability to list local drives.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--f2bc3b89-dcf9-4954-b9da-20e753c47abc","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) has the ability to enumerate fixed logical drives on a targeted system.(Citation: Cisco Ukraine Wipers January 2022)","relationship_id":"relationship--b5a1d3dd-89ea-442a-8695-1aea2cbccafa","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can collect information related to a compromised host, including a list of drives.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--c08ad736-dcd5-465c-92b6-54213ab69614","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can enumerate physical drives on a targeted host.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--a77ba502-576a-47cc-8718-c3f3dcc41b1e","references":[{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) can collect information about a compromised computer's disk sizes.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--cac0eda3-7d8c-42e2-b397-8923cd05f0b8","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1026","name":"Mongall","url":"https://attack.mitre.org/software/S1026","kind":"malware","description":"[Mongall](https://attack.mitre.org/software/S1026) can identify drives on compromised hosts.(Citation: SentinelOne Aoqin Dragon June 2022)\n","relationship_id":"relationship--3a8eb909-108e-4d4c-b893-d76b585caa9b","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) can enumerate drives on a compromised host.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--69262212-bb89-43fc-8a80-ba492766e372","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can enumerate all logical drives on a targeted machine.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--f13b18fe-1596-453f-8dba-43cfa848a5e7","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1048","name":"macOS.OSAMiner","url":"https://attack.mitre.org/software/S1048","kind":"malware","description":"[macOS.OSAMiner](https://attack.mitre.org/software/S1048) has checked to ensure there is enough disk space using the Unix utility `df`.(Citation: SentinelLabs reversing run-only applescripts 2021)","relationship_id":"relationship--0f0b7154-b0d2-4aa1-b819-7d4e3dfe3bd1","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","description":"Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}]},{"id":"S1049","name":"SUGARUSH","url":"https://attack.mitre.org/software/S1049","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) can obtain the number of drives on the victim machine.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--02b6b3cc-ec40-410f-90e9-03c534dc1c12","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can enumerate all drives on a compromised host.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--a38fd59c-489b-4d3a-b3be-54fe89244c71","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can retrieve information about storage drives from an infected machine.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--3c8805ff-7345-4763-9757-6a30acfe652c","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) can enumerate local drives.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--800060e1-5bd0-475a-93d0-e0abc36e10d7","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can enumerate volumes.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)","relationship_id":"relationship--8cef7b12-80af-4bb1-bf72-8eccd835d423","references":[{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":" [Royal](https://attack.mitre.org/software/S1073) can use `GetLogicalDrives` to enumerate logical drives.(Citation: Cybereason Royal December 2022)(Citation: Trend Micro Royal Linux ESXi February 2023)","relationship_id":"relationship--e1da5aff-cead-46b6-a45c-ab7f4e650e05","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","description":"Morales, N. et al. (2023, February 20). Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers. Retrieved March 30, 2023.","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}]},{"id":"S1075","name":"KOPILUWAK","url":"https://attack.mitre.org/software/S1075","kind":"malware","description":"[KOPILUWAK](https://attack.mitre.org/software/S1075) can discover logical drive information on compromised hosts.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--b3bc70ea-4f9e-4933-81e7-eb8b19f89a3b","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to collect the C:\\ drive serial number from a compromised machine.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--937b70c1-3024-4a39-95b0-5f76b8671a66","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can check the disk size through the values obtained with `DeviceInfo.`(Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--43ab17df-742f-4bc5-815a-7da2feed73f0","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}]},{"id":"S1089","name":"SharpDisco","url":"https://attack.mitre.org/software/S1089","kind":"malware","description":"[SharpDisco](https://attack.mitre.org/software/S1089) can use a plugin to enumerate system drives.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--c1004711-9899-4757-8338-428fe33c3411","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) can obtain information on physical drives from targeted hosts.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--88ae2900-c8c5-4943-8baa-7a8ba96dcef5","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) uses the Delphi methods <code>Sysutils::DiskSize</code> and <code>GlobalMemoryStatusEx</code> to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.(Citation: Ensilo Darkgate 2018) ","relationship_id":"relationship--350b8d90-f1ab-4bdf-a47e-8413751ed56c","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can discover and mount hidden drives to encrypt them.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--68f0f623-b5f2-47a8-8206-eabfb472d7aa","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) can collect information about disk drives, their total and free space, and file system type.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--4c06f698-1d15-4758-a38f-d3476ac65fa8","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can enumerate logical drives on targeted devices.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)\n","relationship_id":"relationship--a2fbefb3-bbb7-4c98-8ef1-8440f4ee3bd6","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","description":"MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}]},{"id":"S1151","name":"ZeroCleare","url":"https://attack.mitre.org/software/S1151","kind":"malware","description":"[ZeroCleare](https://attack.mitre.org/software/S1151) can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--029f82d6-72d9-43ac-a480-ae5169d20135","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1168","name":"SampleCheck5000","url":"https://attack.mitre.org/software/S1168","kind":"malware","description":"[SampleCheck5000](https://attack.mitre.org/software/S1168) can create unique victim identifiers by using the compromised system’s volume ID.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--2b1b3740-cbf5-47cb-8a91-1b2c9a683342","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can enumerate local drive configuration.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--83b9dc24-fc85-40dd-ad6e-f8eeededc53f","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can enumerate local drive configuration.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--39ef8d48-fb74-412a-8c6d-b889e3fca644","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"PUBLOAD has leveraged `wmic logicaldisk get` to map local network drives.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)","relationship_id":"relationship--a38cfd4a-0ba2-49ae-98e9-df6c1f954148","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C:` to identify the victim machine.(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)","relationship_id":"relationship--4dfa38d4-a6e6-4fab-bff8-23cab8ffa9cd","references":[{"source_name":"ATTACKIQ MUSTANG PANDA TONESHELL March 2023","description":"Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.","url":"https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.(Citation: Halcyon Qilin.B OCT 2024)\n","relationship_id":"relationship--85e94a33-82be-46f4-b6e5-766f5f5e5a56","references":[{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has enumerated logical drives on infected hosts.(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--68be315f-f84b-4790-892b-e284089658a8","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"[AshTag](https://attack.mitre.org/software/S9031) can use `volumeserialnumber` to enumerate volumes.(Citation: Palo Alto Ashen Lepus DEC 2025) ","relationship_id":"relationship--f1c35f20-cd82-4ecb-b958-c6abc86d9dc4","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has used the Microsoft Windows native `GetLogicalDrives()` and `GetDriveType()` functions to enumerate all the drives visible to the system.(Citation: CERT Polska)","relationship_id":"relationship--501b58a3-5315-4415-8e4a-b2ee65db5013","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has discovered and enumerated valid drives through a PowerShell script.(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also scanned for letter drives from A: to Z: using `os.Stat` to determine valid drives.(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--d36642ab-c972-4b23-b528-b25ea835031c","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has enumerated logical drives on impacted devices.(Citation: CheckPoint_NimbusManticore_May2026) ","relationship_id":"relationship--a5f8752d-2df3-45b2-ab03-9e9261971bc6","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"A Destover-like variant used by [Lazarus Group](https://attack.mitre.org/groups/G0032) collects disk space information and sends it to its C2 server.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)","relationship_id":"relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e","references":[{"source_name":"Novetta Blockbuster Destructive Malware","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","description":"Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"[Patchwork](https://attack.mitre.org/groups/G0040) enumerated all available drives on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--bdbd15f2-3c02-4f3a-b824-60f7f815c9c3","references":[{"source_name":"Cymmetria Patchwork","description":"Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has detected a target system’s system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--a1cb6aec-0f1c-491e-9648-b668014e3aee","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has enumerated drives.(Citation: Talos Kimsuky Nov 2021)(Citation: Securelist Kimsuky Sept 2013)(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--fa4c9d50-529f-4166-a65d-3c4f28496fb7","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--c3556085-d0ed-41dc-9ed4-a0a0c65ee104","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) collected the system volume serial number.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes Higaisa 2020)","relationship_id":"relationship--b64b605f-2677-47c3-ae4b-0b3db3573eae","references":[{"source_name":"Malwarebytes Higaisa 2020","description":"Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"PTSecurity Higaisa 2020","description":"PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has searched for disk partition and logical volume information.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--01183e54-1494-4fad-ab62-60834746cc32","references":[{"source_name":"ATT TeamTNT Chimaera September 2020","description":"AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0142","name":"Confucius","url":"https://attack.mitre.org/groups/G0142","kind":"intrusion-set","description":"[Confucius](https://attack.mitre.org/groups/G0142) has used a file stealer that can examine system drives, including those other than the C drive.(Citation: TrendMicro Confucius APT Aug 2021)","relationship_id":"relationship--8135fc16-4dda-4afb-bc35-d24c370b0c53","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","description":"Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021.","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has discovered file system types, drive names, size, and free space on compromised systems.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--514a384a-2b09-4b4f-9def-8e4007b49734","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","description":"Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","description":"NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has collected information on bootable drives including model, vendor, and serial numbers.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--efab47f3-cd77-41a5-bb8d-34ee3911d07d","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]}],"mitigations":[],"candidates":[{"id":"1c11a623-e783-4b2f-ad4a-0a62591e8f85","name":"Local Storage Discovery via wmic ","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1680/T1680.yaml","description":"Will enumerate logical drives and file system details using the \"Get-PSDrive\" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system.","inputs":{},"dependencies":[],"source_definition_sha256":"3ab829b8adc684bf0a9b8209c629f7f25931301e25d9c747779a8f290fa4a167"},{"id":"3a4d51bd-b0f5-4249-821c-ba8997c42c00","name":"Local Storage Discovery via PSDrive","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1680/T1680.yaml","description":"Will enumerate logical drives and file system details using the \"Get-PSDrive\" Powershell cmdlet. Get-Volume is then used to get details status, capacity, and file system information for all storage volumes on a system.","inputs":{},"dependencies":[],"source_definition_sha256":"1e65673411622458df7f1ae1fc44921b1253607b7dc9cac3d3e7a062520f28ba"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1006":"/ttp-simulation/techniques/enterprise/T1006/","T1059.012":"/ttp-simulation/techniques/enterprise/T1059.012/","T1680":"/ttp-simulation/techniques/enterprise/T1680/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1680","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}