MITRE ATT&CKtechnique

T1533 Data from Local System

Published 2019-10-10 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android, iOS
Version
1.1
Created
2019-10-10

Description

Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration. Access to local system data, which includes information stored by the operating system, often requires escalated privileges. Examples of local system data include authentication tokens, the device keyboard cache, Wi-Fi passwords, and photos. On Android, adversaries may also attempt to access files from external storage which may require additional storage-related permissions.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (55)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S1243 DCHSpy software (malware)
  • S1241 RatMilad software (malware)
  • C0054 Operation Triangulation campaign
  • S1215 Binary Validator software (malware)
  • S1216 TriangleDB software (malware)
  • S1185 LightSpy software (malware)
  • S1126 Phenakite software (malware)
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1092 Escobar software (malware)
  • S1083 Chameleon software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1080 Fakecalls software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1054 Drinik software (malware)
  • C0016 Operation Dust Storm campaign
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0544 HenBox software (malware)
Show all 55 ›

References