MITRE ATT&CKtechnique

T1005 Data from Local System

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.8
Created
2017-05-31

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1057 Data Loss Prevention mitigation

Referenced by MITRE ATT&CK · uses (236)

  • S9065 DCSYNCER.SLICK software (malware)
  • S9058 SIGHTGRAB software (malware)
  • S9059 MiniBike software (malware)
  • S9052 MiniFast software (malware)
  • S9050 Vidar software (malware)
  • G1056 TeamPCP group
  • S9035 LAMEHUG software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • G1055 VOID MANTICORE group
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9010 GlassWorm software (malware)
  • S9009 TruffleHog software (tool)
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • S1240 RedLine Stealer software (malware)
  • S1229 Havoc software (malware)
  • S1224 CASTLETAP software (malware)
  • G1045 Salt Typhoon group
  • S1200 StealBit software (malware)
  • S1196 Troll Stealer software (malware)
  • C0048 Operation MidnightEclipse campaign
  • G1039 RedCurl group
  • S1159 DUSTTRAP software (malware)
  • S1160 Latrodectus software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
Show all 236 ›

Referenced by CAPEC · att&ck technique (4)

  • CAPEC-204 Lifting Sensitive Data Embedded in Cache attack pattern
  • CAPEC-37 Retrieve Embedded Sensitive Data attack pattern
  • CAPEC-545 Pull Data from System Resources attack pattern
  • CAPEC-647 Collect Data from Registries attack pattern

Referenced by Compliance · mitigates (18)

  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • CIS-3.3 Configure Data Access Control Lists CIS Safeguard v8.1
  • CIS-3.5 Securely Dispose of Data CIS Safeguard v8.1
  • CIS-3.6 Encrypt Data on End-User Devices CIS Safeguard v8.1
  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-38 Operations Security NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References