Data from Local System
Where this stands
A Sigma rule exists for this technique in the corpus.
A detection for this technique exists in the corpus. Log in to read it.
When a detection for this fires
Collection and exfiltrationData being gathered or moved. This is where a security incident becomes a disclosure obligation.What the technique is
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1070
Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.
- AN1071
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
- AN1072
Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.