type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--4dcd8ba3-2075-4f8b-941e-39884ffaac08
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0046
external_id: DC0046
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Drive Modification
description: The alteration of a drive letter, mount point, or other attributes of a data storage device, which could involve reassignment, renaming, permissions changes, or other modifications. Examples: 

- Drive Letter Reassignment: A USB drive previously assigned `E:\` is reassigned to `D:\` on a Windows machine.
- Mount Point Change: On a Linux system, a mounted storage device at `/mnt/external` is moved to `/mnt/storage`.
- Drive Permission Changes: A shared drive's permissions are modified to allow write access for unauthorized users or processes.
- Renaming of a Drive: A network drive labeled "HR_Share" is renamed to "Shared_Resources."
- Modification of Cloud-Integrated Drives: A cloud storage mount such as Google Drive is modified to sync only specific folders.

This data component can be collected through the following measures:

Windows Event Logs

- Relevant Events:
 - Event ID 98: Indicates changes to a volume (e.g., drive letter reassignment).
 - Event ID 1006: Logs permission modifications or changes to removable storage.
- Configuration: Enable "Storage Operational Logs" in the Event Viewer:
`Applications and Services Logs > Microsoft > Windows > Storage-Tiering > Operational`

Linux System Logs

- Auditd Configuration: Add audit rules to track changes to mounted drives: `auditctl -w /mnt/ -p w -k drive_modification`
- Command-Line Monitoring: Use `dmesg` or `journalctl` to observe drive modifications.

macOS System Logs

- Unified Logs: Collect mount or drive modification events: `log show --info | grep "Volume modified"`
- Command-Line Monitoring: Use `diskutil` to track changes:

Endpoint Detection and Response (EDR) Tools

- Configure policies in EDR solutions to monitor and log changes to drive configurations or attributes.

SIEM Tools

- Aggregate logs from multiple systems into a centralized platform like Splunk to correlate events and alert on suspicious drive modification activities.

x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Drive
channel: None
name: networkdevice:runtime
channel: Firmware image uploaded via TFTP/FTP/SCP
name: WinEventLog:Sysmon
channel: Raw disk write access via \\.\PhysicalDrive* or \\.\C:
name: macos:unifiedlog
channel: IOKit disk write calls targeting raw devices
name: linux:syslog
channel: Block device write errors or unusual bootloader activity
name: networkdevice:firmware
channel: Unexpected firmware image upload events via TFTP/FTP/SCP
name: WinEventLog:Sysmon
channel: Raw write attempts targeting \\.\PhysicalDrive0 or sector 0 (MBR/partition table)
name: macos:unifiedlog
channel: IOKit raw disk write to EFI/boot partition sectors
name: WinEventLog:Sysmon
channel: Raw disk writes targeting \\.\PhysicalDrive* or MBR locations
name: macos:unifiedlog
channel: IOKit raw disk write activity targeting physical devices