.. /df

Star

Provides disk utilisation statistics of attached volumes.

• https://www.trellix.com/en-au/blogs/research/ransomhouse-am-see/

System Information

1. Displays information regarding available storage on a ESXi host

   df -h -P -x"squashfs" | awk '{print $1"\t"$2"\t"$3"\t"$4"\t"$5"\t"$6}'

   Use case

   An adversary may obtain information about existing storage availability to plan subsequent operations. Above command provides outputs available disk space in human readable format in POSIX format. It excludes the squashfs and then prints the first 6 columns from the output. Note that the -P and -x switches are not available in ESXi so the exact command may not get executed successfully.

   Privileges required

   Administrator

   Operating systems

   ESXi

   ATT&CK® technique

   T1082

   
   

   Tags

   E-Crime: RansomHouse

   A RaaS group that uses MrAgent tool to target VMWARE ESXi hosts