Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Identifying EBS Volumes and Mount Points with lsblk

Managing EBS volumes effectively is crucial for AWS users, especially when multiple volumes with identical sizes are attached to an instance. Identifying which volume is mounted where can save time and avoid potential errors. So we can…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Managing EBS volumes effectively is crucial for AWS users, especially when multiple volumes with identical sizes are attached to an instance. Identifying which volume is mounted where can save time and avoid potential errors.



So we can use lsblk command. lsblk command is basically used to check the information of block devices connected to our system.



In this demonstration, I will show how to identify the EBS Volume ID using the lsblk command, which is a powerful command for viewing detailed information about block devices connected to a system.



First I have created one ec2 instance with t3.micro instance type and os is amazon linux 2023 and i have attached same size of EBS volumes.



Image description



I have mounted both on linux system.



Image description



Now I have to identify which EBS volume is mounted on which path.

I can use lsblk command with --output option.

Also we can mention which specific type of information we need to check of that block device.

There are several information like Name, Size, Mountpoint, File System type, UUID and so many.



In my case, I am retrieving details such as the name, file system type, device type, size, mount point, and serial number.



To obtain this information, I am using the following command:

lsblk --output NAME,TYPE,SIZE,FSTYPE,MOUNTPOINT,SERIAL



Image description



The SERIAL column represents the volume ID, which directly maps to the AWS EBS volume, making it easy to identify.



Based on the output, volume id vol0ba857296d76cd457 is mounted on /root/test

and volume id vol090411f87c15fe113 is mounted on /root/test1



and both have the same size.



Conclusion

This method is invaluable for managing EBS volumes in scenarios where volume size alone cannot differentiate between devices. Next time you need to resize, detach, or remove a specific volume, the lsblk command ensures accuracy and efficiency.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Identifying EBS Volumes and Mount Points with lsblk
id: e1bb1092-7e3b-4b75-9f9a-f06ab3374730
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Identifying EBS Volumes and Mo" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Identifying EBS Volumes and Mount Points")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Identifying EBS Volumes and Mount Points*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Identifying EBS Volumes and Mount Points"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Identifying EBS Volumes and Mount Points with lsblk

Thematisch verwandte Begriffe: Identifying, Volumes, Mount, Points · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag