AN0536
Analytic 0536
Windows
Drive enumeration using PowerShell (`Get-PSDrive`), `wmic logicaldisk`, or Win32 API indicative of local volume enumeration by non-admin users or executed outside of baseline system inventory scripts.
WinEventLog:Sysmon
EventCode=1
[user_context]
Non-system accounts performing drive enumeration may be higher fidelity indicators
[parent_process_name]
Baseline parent-child process lineage can help distinguish admin tools from malicious scripts
AN0537
Analytic 0537
Linux
Abnormal use of `lsblk`, `fdisk -l`, `lshw -class disk`, or `parted` by non-admin users or within non-interactive shells suggests suspicious disk enumeration activity.
auditd:SYSCALL
execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)
auditd:EXECVE
command line arguments containing lsblk, fdisk, parted
[TTY_type]
Detection can exclude interactive TTY sessions to reduce false positives from admin usage
[shell_parent]
Differentiate between interactive user shells vs. script-based execution
AN0538
Analytic 0538
macOS
Disk enumeration via `diskutil list` or `system_profiler SPStorageDataType` run outside of user login or not associated with system inventory tools
macos:unifiedlog
process launch of diskutil or system_profiler with SPStorageDataType
macos:unifiedlog
log messages related to disk enumeration context or Terminal session
[launch_agent_context]
Unexpected use of disk enumeration tools from GUI apps or LaunchAgents may indicate abuse
[volume_name_filter]
Filter known baseline volume names or identifiers used by common device configurations
AN0539
Analytic 0539
ESXi
Use of `esxcli storage` or `vim-cmd vmsvc/getallvms` by unusual sessions or through interactive shells unrelated to administrative maintenance tasks.
esxi:hostd
execution of esxcli with args matching 'storage', 'filesystem', 'core device list'
esxi:auth
interactive shell or SSH access preceding storage enumeration
[ssh_source_ip]
Restrict alerts to unexpected remote sessions accessing host storage commands
[esxcli_command_scope]
Tailor detection based on subcommands more likely to be abused