An embodiment of a system and method for providing storage device-based advanced persistent threat (APT) protection receives a file write request of a file object, writes the file object to a temporary storage device, computes a hash value of the file object in the temporary storage device, and compares the hash value of the file object to hash values stored in an APT database to determine if the hash value of the file object exists in the APT database. If the hash value of the file object exists in the APT database, an embodiment writes the file object to a quarantine storage location and clears the file object from the temporary storage device. If the hash value of the file object does not exist in the APT database, an embodiment executes an APT analysis on the file object to determine if the file object presents an APT.