How do attackers use Local Storage Discovery?

What attackers look for during local storage discovery

local storage discovery is usually a preparatory step, not the end goal. Attackers use it to quickly map where useful data lives on a host, then decide what to stage for theft or encryption. The value is in speed and reach, especially when the environment includes user profiles, shared folders, backup locations, sync clients, or external media.

On Windows and similar endpoints, the activity often starts with broad enumeration: drives, mounted volumes, removable media, recent documents, desktop and downloads folders, cloud-sync directories, and application data paths. That pattern matters because it turns ordinary file-system visibility into a targeting method. The same technique can expose documents, browser artifacts, and tokens or configuration files that are present because of normal user and app behaviour.

Attackers also use discovery to locate data that is valuable because it is adjacent to the system, not only stored in the obvious places. Backup repositories, temporary working folders, offline caches, portable media, and mapped network shares can all widen the blast radius. When the objective is ransomware, this step helps identify high-value files and reachable storage before encryption begins; when the objective is espionage, it helps identify what can be copied with minimal noise.

A useful defender lens is the MITRE ATT&CK Guide for Defenders, because local storage discovery is one of the classic ways attackers identify files and directories worth targeting and then sequence that discovery into follow-on collection or impact.

Why local storage discovery often precedes collection or encryption

The main reason this technique appears early is efficiency. Attackers want to reduce guesswork before they exfiltrate data, stage archives, or launch encryption. Discovery gives them a short list of likely targets and a sense of where high-value material is concentrated. It also helps them avoid spending time on low-value folders that might create alerts without improving results.

Discovery becomes more dangerous when it is paired with search for local evidence of authentication material, such as session files, cached tokens, or browser-stored data. Those artefacts are often not the primary target in a file-discovery operation, but they can materially change what the attacker can do next. If a host already contains useful credentials or application state, the discovery phase can become a gateway to wider access.

Attackers often try to stay within normal user activity patterns while they enumerate storage. That means short bursts of listing, filtering, and file selection rather than one dramatic dump of the whole disk. The operational goal is to find enough value to justify the next step without triggering obvious disruption too early. In practice, that makes the technique look like routine file browsing unless teams are watching for volume, scope, and timing.

For the broader adversary pattern, the MITRE ATT&CK Enterprise Matrix is the best reference for how discovery activities connect to credential access, collection, and later impact. For host-focused hunt work, it also helps separate simple enumeration from a broader intrusion sequence.

What defenders should watch for and investigate first

Detection should focus on behaviour that is unusual for the user or process, not on file access alone. Good signals include rapid traversal of user directories, enumeration of all drives or removable media, access to backup or synchronisation paths, and repeated probing of many folders in a short time. A single read of a document is less interesting than broad scanning followed by selective collection.

Context is critical. Legitimate backup software, endpoint management tools, search indexing, and user file browsing can generate similar events. The difference is usually in timing, scope, and the account or process involved. Suspicion rises when a non-administrative process touches many storage locations, when enumeration happens just before compression or archive creation, or when discovery occurs on a system that does not normally handle large local datasets.

Investigation should ask three questions quickly: what was enumerated, what was copied or staged next, and whether the same host shows signs of preparatory compromise such as suspicious logon activity, new persistence, or unusual archive utilities. If the same account is touching drives, shares, and sync folders across multiple sessions, the behaviour may indicate a theft path rather than casual browsing. The CISA cyber threat advisories page is useful for keeping that investigation aligned with current intrusion patterns and defensive priorities.

Practitioner Guidance

What to verify: Confirm whether the process that performed discovery is expected to enumerate multiple storage roots, removable media, and backup or sync locations. If not, treat the behaviour as pre-exfiltration or pre-encryption staging until proven otherwise.

Decision rule: If discovery is followed by archive creation, bulk reads, or access to removable media, prioritise containment and preservation over broad endpoint tuning. If the activity is limited to one known tool and one expected path, validate the business justification before escalating.

What practitioners underestimate: Local storage discovery is often noisy in hindsight but subtle in real time. The risk is not the listing itself, it is the attacker using that listing to choose the few paths that matter most.

Practitioner takeaway: The right control objective is not to block every file enumeration, but to catch when enumeration becomes targeted staging for theft, token recovery, or destructive impact.

Related resources from NHI Mgmt Group

• How do attackers use thread local storage?
• How do attackers use list planting?
• How do attackers use invisible Unicode?
• How do attackers turn a supply-chain incident into wider NHI compromise?