Local drive and volume enumeration from the command line

Siemphony@siemphonylowT1680unverified

AN0536's Windows shape: a process-creation record whose command line carries one of the built-in ways to list local drives, disks and volumes with their size, free space and serial number — `wmic logicaldisk get`, any reference to the Win32_LogicalDisk / Win32_Volume / Win32_DiskDrive WMI classes from PowerShell or a script, `Get-PSDrive`, `Get-Volume`, and the two fsutil subcommands that report the drive list and free space. The gate is the command line alone with no image restriction, deliberately: `logicaldisk` reaches the same enumeration whether it is typed at wmic.exe, passed to Get-WmiObject/Get-CimInstance, or run from a renamed copy of either, and an image list would have to be re-derived for each of those. Three limits are structural. The technique's Win32 API route (`GetDriveType`, `GetLogicalDrives`) leaves no command line at all and is invisible here; a cmdlet typed into an already-running PowerShell console never reaches a process-creation event, so only `-Command`/`-EncodedCommand` style invocations and scripts launched as their own process appear; and an encoded or obfuscated command line defeats every substring above. This rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine), which is the log source the analytic names; where the same Sigma category is fed by Security EventID 4688 instead, that channel needs *Audit Process Creation* plus the separate *Include command line in process creation events* policy before CommandLine holds anything, and a field mapping to NewProcessName first. The brief's Linux and macOS analytics (AN0537, AN0538) are separate log sources and are not covered here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0188, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "logicaldisk" or ProcessCommandLine contains "Win32_Volume" or ProcessCommandLine contains "Win32_DiskDrive" or ProcessCommandLine contains "Get-PSDrive" or ProcessCommandLine contains "Get-Volume" or ProcessCommandLine contains "fsutil fsinfo drives" or ProcessCommandLine contains "fsutil volume diskfree")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*logicaldisk*" OR CommandLine="*Win32_Volume*" OR CommandLine="*Win32_DiskDrive*" OR CommandLine="*Get-PSDrive*" OR CommandLine="*Get-Volume*" OR CommandLine="*fsutil fsinfo drives*" OR CommandLine="*fsutil volume diskfree*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*logicaldisk*" OR TO_LOWER(process.command_line) LIKE "*win32_volume*" OR TO_LOWER(process.command_line) LIKE "*win32_diskdrive*" OR TO_LOWER(process.command_line) LIKE "*get-psdrive*" OR TO_LOWER(process.command_line) LIKE "*get-volume*" OR TO_LOWER(process.command_line) LIKE "*fsutil fsinfo drives*" OR TO_LOWER(process.command_line) LIKE "*fsutil volume diskfree*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(logicaldisk|Win32_Volume|Win32_DiskDrive|Get-PSDrive|Get-Volume|fsutil fsinfo drives|fsutil volume diskfree)</field>    <description>Local drive and volume enumeration from the command line</description>    <mitre>      <id>T1680</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bb3bcc4c-7c8b-4789-9f06-815090e9de42

ATT&CKT1680

T1680Local Storage Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

"Local drive and volume enumeration from the command line" is the Windows leg of DET0188, grounded in analytic AN0536. It looks for a process-creation record whose command line carries one of the built-in ways to list local drives, disks and volumes with their size, free space and serial number. This is the reconnaissance moment before staging or encryption, not the damage itself — a hit tells you someone asked the host what storage it has, and nothing more.

02 · Telemetry you need

Sysmon EventID 1, mapped to the Sigma process_creation / windows logsource copied verbatim from the analytic. The rule reads only CommandLine, so a Sysmon config that captures process creation without command lines makes it inert. The vocabulary here is Sysmon's; if your process_creation pipeline is fed by Security 4688 instead, that channel needs Audit Process Creation plus the separate Include command line in process creation events policy before CommandLine holds anything, and a field mapping to NewProcessName first. Neither is on by default.

03 · How the logic works

One selection, one field, seven substrings under CommandLine|contains, and a bare condition: selection. Three cover WMI: logicaldisk is the WMIC alias and also appears inside Win32_LogicalDisk, so it catches both wmic logicaldisk get freespace and a PowerShell Get-CimInstance Win32_LogicalDisk; Win32_Volume and Win32_DiskDrive catch the sibling classes. Two are PowerShell cmdlets, Get-PSDrive and Get-Volume. Two are fsutil subcommands written as whole phrases, fsutil fsinfo drives and fsutil volume diskfree, so the words do not match apart. There is deliberately no Image gate. The same enumeration is reachable from wmic.exe, from powershell.exe, from a script host, or from a renamed copy of any of them, and an image list would have to be re-derived for each. The cost is that the string list is the only gate, and it has gaps: wmic diskdrive, wmic volume, wmic partition, Get-Disk and Get-Partition reach the same data and do not match. The technique's Win32 API route leaves no command line at all, and a cmdlet typed into an already-running console never produces a process-creation event.

04 · Common false positives

Loudly, and from software rather than people. Hardware-inventory agents — Configuration Manager, Lansweeper, PDQ, GLPI — query Win32_LogicalDisk and Win32_DiskDrive on a schedule on every managed host; in any managed estate this is the top match by a wide margin. Disk-space checks from Zabbix, Nagios, PRTG and SolarWinds add a steady per-host beat. Installers and MSI custom actions test free space before writing, imaging task sequences enumerate volumes to pick a target, and logon scripts call Get-PSDrive once per session. The rule is scored low because its own first false positive is the highest-volume match.

05 · Detection maturity

tier_1: Lowest tier. This rule was derived from MITRE's prose and has never been run against a log line — its match rate, its false-positive volume and even whether your Sysmon config populates the field it reads are all unmeasured. It climbs only after you execute it over real historical data, count what it returns, and write down what you excluded and why.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE gives AN0536 two mutable elements: user_context and parent_process_name. Neither is expressed in the rule as written — the seven substrings are the pipeline's own choice, not MITRE's. The parent knob is where the volume goes: exclude the lineage of your inventory and monitoring agents on ParentImage, and what remains is enumeration nobody scheduled. The user knob adds fidelity on top, filtering User down to non-system accounts or gating on IntegrityLevel. Close the coverage gaps first by adding the missing aliases, keeping wmic prefixed on bare words so volume does not match every path containing it.

Declared by the author

Software and hardware inventory agents — Configuration Manager hardware inventory, Lansweeper, PDQ Inventory, GLPI agents — which query Win32_LogicalDisk and Win32_DiskDrive on a schedule on every managed host. This is the highest-volume match by a wide margin in any managed estate and is why the rule is scored low; exclude the agent's own process lineage before raising it.
Disk-space monitoring checks from Zabbix, Nagios, PRTG, SolarWinds and similar, which run wmic logicaldisk get freespace or fsutil volume diskfree at a fixed interval and produce a steady per-host beat of matches.
Installers and MSI custom actions that test free space before writing, and imaging or deployment task sequences that enumerate volumes to choose a target disk — bursts of matches during patch windows and machine builds.
Logon and helpdesk scripts calling Get-PSDrive to verify or report mapped drives, which fires once per interactive session on the hosts that deploy them.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1680, evaluated against their process_creation events.

Share this rule

/u/siemphony/bb3bcc4c-7c8b-4789-9f06-815090e9de42

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Local drive and volume enumeration from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it