Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use Automated Collection on the local system.
Platforms
Mitigations (1)
Data Loss PreventionM1057
Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.
Threat Groups (46)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) collected data from the victim's local system, including password hashes from the SAM hive in the Reg... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) will identify Microsoft Office documents on the victim's computer.(Citation: aptsim) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has collected Office, PDF, and HWP documents from its victims.(Citation: Securelist Kimsuky Sept 2013... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has stolen files from a sensitive file server and the Active Directory database from targeted en... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork) |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021) |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has collected data from local victim systems.(Citation: US-CERT TA18-074A) |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has collected various files from the compromised computers.(Citation: DOJ APT10 Dec 2018)(Citation: ... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has collected data and files from a compromised machine.(Citation: Rapid7 HAFNIUM Mar 2021)(Citation:... |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has collected and exfiltrated payment card data from compromised systems.(Citation: Trend Micro FIN6 Oct... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has collected files from infected systems and uploaded them to a C2 server.(Citation: ESET Ga... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Ca... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has exfiltrated internal documents, files, and other data from compromised hosts.(Citation: US ... |
| G0138 | Andariel | [Andariel](https://attack.mitre.org/groups/G0138) has collected large numbers of files from compromised network systems for later extraction.(Citation... |
| G1012 | CURIUM | [CURIUM](https://attack.mitre.org/groups/G1012) has exfiltrated data from a compromised machine.(Citation: Microsoft Iranian Threat Actor Trends Novem... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 201... |
| G0067 | APT37 | [APT37](https://attack.mitre.org/groups/G0067) has collected data from victims' local systems.(Citation: FireEye APT37 Feb 2018) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used PowerShell to upload files from compromised systems.(Citation: Trend Micro Earth Simnavaz Oct... |
| G0124 | Windigo | [Windigo](https://attack.mitre.org/groups/G0124) has used a script to gather credentials in files left on disk by OpenSSH backdoors.(Citation: ESET Fo... |
Associated Software (169)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) collects local files and information from the victim’s local machine.(Citation: S2 Grupo TrickBot ... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has uploaded files from victim machines.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can collect data from a compromised host.(Citation: Profero APT27 December 2020)(Citation: Trend ... |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can collect files from a compromised host.(Citation: Microsoft Actinium February 2022) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can capture and compress stolen credentials from the Registry and volume shadow copies.(Citation:... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has commands that allow the actor download files from the compromised host to the C2 server, and... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) can collect information from a compromised host.(Citation: BlackBerry Amadey 2020) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) searches the local system and gathers data.(Citation: McAfee GhostSecret) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf,... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can gather information from compromised hosts.(Citation: Mandiant Suspected Turla Campaign Februa... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to collect data from a compromised machine to deliver to the attacker.(Citation: S... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) has collected files and data from a compromised host.(Citation: Cylance Dust Storm) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has collected files from victim machines, including certificates and cookies.(Citation: TrendMicro B... |
| S1224 | CASTLETAP | Malware | [CASTLETAP](https://attack.mitre.org/software/S1224) can execute a C2 command to transfer files from victim machines.(Citation: Mandiant Fortinet Zero... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) can collect data and files from a compromised host.(Citation: Kaspersky ThreatNeedle Feb 2021) |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) can download files from the victim's computer.(Citation: Havoc Framework Documentation)(Citation: Imm... |
| S0503 | FrameworkPOS | Malware | [FrameworkPOS](https://attack.mitre.org/software/S0503) can collect elements related to credit card data from process memory.(Citation: SentinelOne Fr... |
| S0237 | GravityRAT | Malware | [GravityRAT](https://attack.mitre.org/software/S0237) steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pd... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has collected data utilizing a script that contained a list of excluded files and directory... |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) collects files from the local system.(Citation: McAfee Bankshot) |
References
- Cisco. (2022, August 16). show running-config - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022.
- Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1005 (Data from Local System)?
T1005 is a MITRE ATT&CK technique named 'Data from Local System'. It belongs to the Collection tactic(s). Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to...
How can T1005 be detected?
Detection of T1005 (Data from Local System) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1005?
There are 1 documented mitigations for T1005. Key mitigations include: Data Loss Prevention.
Which threat groups use T1005?
Known threat groups using T1005 include: APT38, GALLIUM, APT3, Kimsuky, Volt Typhoon, Patchwork, APT41, Dragonfly.