T1005
Data from Local System
ESXi · Linux · macOS · Network Devices · Windows1 piece on this siteT1005 on attack.mitre.org
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
Read
Analyses, case studies, guides, references and interview questions.
Case study: one appliance, and the disclosure that followed
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
how MITRE says to see it
Detection of Local Data Collection Prior to Exfiltration
- Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.
- Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
- Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.
- Collection of device configuration via CLI commands (e.g., `show running-config`, `copy flash`, `more`), often followed by TFTP/SCP transfers.
what reduces it
- M1057 Data Loss Prevention. Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.