T1680 IBM QRadar · QRadar

Detect Local Storage Discovery in IBM QRadar

This detection identifies adversary attempts to enumerate local drives, disks, volumes, and storage attributes across Windows, Linux, macOS, and ESXi platforms. Attackers use tools such as wmic logicaldisk, Get-PSDrive, lsblk, fdisk, diskutil, esxcli, and cloud CLI commands to gather disk size, free space, volume serial numbers, and partition layouts. Storage discovery is a critical precursor to ransomware encryption (to identify all encryptable volumes), lateral movement targeting network shares, and direct volume access attacks. Groups like TeamTNT and malware families including Cuba ransomware and ZeroCleare have demonstrated this behavior in production incidents.

MITRE ATT&CK

Tactic
Discovery
Technique
T1680 Local Storage Discovery
Canonical reference
https://attack.mitre.org/techniques/T1680/

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS LogSource,
    "username" AS AccountName,
    "CommandLine" AS CommandLine,
    "ParentProcessName" AS ParentProcess,
    "NewProcessName" AS ProcessName,
    CASE
        WHEN "CommandLine" ILIKE '%powershell%' AND "CommandLine" ILIKE '%-enc%' THEN 'EncodedCommand'
        WHEN "CommandLine" ILIKE '%bypass%' THEN 'ExecutionBypass'
        WHEN "CommandLine" ILIKE '%-noprofile%' THEN 'NoProfileExecution'
        ELSE 'SuspiciousProcess'
    END AS DetectionType,
    CASE
        WHEN "username" = 'SYSTEM' THEN 70
        WHEN "CommandLine" ILIKE '%bypass%' THEN 85
        ELSE 60
    END AS RiskScore
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
    AND eventid IN (4688, 1)
    AND ("NewProcessName" ILIKE '%powershell.exe%'
        OR "NewProcessName" ILIKE '%cmd.exe%'
        OR "NewProcessName" ILIKE '%wscript.exe%'
        OR "NewProcessName" ILIKE '%cscript.exe%'
        OR "NewProcessName" ILIKE '%mshta.exe%')
    AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURS
medium severity medium confidence

IBM QRadar AQL detection for Local Storage Discovery (T1680). Queries QRadar event pipeline for indicators consistent with local storage discovery adversary techniques using MITRE ATT&CK-aligned event categorization.

Data Sources

IBM QRadar SIEMWindows Security EventsEndpoint Agent

Required Tables

events

False Positives & Tuning

  • Backup agents (Veeam, Commvault, Veritas) routinely enumerate disk volumes before backup operations
  • System administration scripts and IT automation tools (Ansible, Chef, Puppet) checking disk capacity for health monitoring
  • Windows disk cleanup utilities and OS maintenance tasks invoking fsutil or wmic for storage information
Download portable Sigma rule (.yml)

Other platforms for T1680

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 6 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Windows WMIC LogicalDisk Enumeration

    Expected signal: DeviceProcessEvents: FileName=wmic.exe, ProcessCommandLine contains 'logicaldisk get'. Security Event 4688 if process creation auditing enabled. Sysmon EventCode=1 with full command line.

  2. Test 2PowerShell Storage Enumeration via Get-Disk and Get-Volume

    Expected signal: DeviceProcessEvents: FileName=powershell.exe, ProcessCommandLine contains 'Get-Disk' and 'Get-Volume'. PowerShell Script Block Logging (Event 4104) will record the script block if enabled. Sysmon EventCode=1.

  3. Test 3DiskPart Volume and Disk Listing

    Expected signal: DeviceProcessEvents: FileName=diskpart.exe with /s flag and temp file path. DeviceFileEvents: temp script file creation in %TEMP%. Security Event 4688 or Sysmon EventCode=1.

  4. Test 4Linux Block Device Enumeration

    Expected signal: Syslog or auditd EXECVE records for lsblk, fdisk, df, blkid. auditd: type=EXECVE msg containing lsblk and fdisk arguments. bash history update.

  5. Test 5ESXi Storage Enumeration via esxcli

    Expected signal: ESXi shell.log (/var/log/shell.log): command execution entries for esxcli storage filesystem list and vim-cmd. Syslog entries if syslog forwarding is configured to a SIEM.

  6. Test 6AWS Cloud Volume Discovery

    Expected signal: AWS CloudTrail: DescribeVolumes and DescribeInstances API calls with sourceIPAddress, userIdentity.arn, and eventTime. CloudTrail log should appear in S3 bucket within 15 minutes.

Last updated: 2026-03-20 Research depth: deep
References (9)

Unlock Pro Content

Get the full detection package for T1680 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1006Direct Volume AccessT1486Data Encrypted for ImpactT1083File and Directory DiscoveryT1057Process DiscoveryT1082System Information DiscoveryT1490Inhibit System RecoveryT1059.001PowerShellT1059.003Windows Command ShellT1059.012Hypervisor CLI

Same Tactic: Discovery

Popular Detections