t1005-data-from-local-system

name	T1005_data-from-local-system
description	Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior...
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1005","collection","esxi","linux","macos","network-devices","windows"]
technique_id	T1005
tactic	collection
all_tactics	["collection"]
platforms	["ESXi","Linux","macOS","Network Devices","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1005
tech_stack	["esxi","linux","macos","network devices","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1005 Data from Local System

High-Level Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.

Kill Chain Phase

• Collection (TA0009)

Platforms: ESXi, Linux, macOS, Network Devices, Windows

What to Check

• Identify if Data from Local System technique is applicable to target environment
• Check ESXi systems for indicators of Data from Local System
• Check Linux systems for indicators of Data from Local System
• Check macOS systems for indicators of Data from Local System
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Search files of interest and save them to a single zip file (Windows)

This test searches for files of certain extensions and saves them to a single zip file prior to extraction.

Supported Platforms: windows

$startingDirectory = "#{starting_directory}"
$outputZip = "#{output_zip_folder_path}"
$fileExtensionsString = "#{file_extensions}"
$fileExtensions = $fileExtensionsString -split ", "

New-Item -Type Directory $outputZip -ErrorAction Ignore -Force | Out-Null

Function Search-Files {
  param (
    [string]$directory
  )
  $files = Get-ChildItem -Path $directory -File -Recurse | Where-Object {
    $fileExtensions -contains $_.Extension.ToLower()
  }
  return $files
}

$foundFiles = Search-Files -directory $startingDirectory
if ($foundFiles.Count -gt 0) {
  $foundFilePaths = $foundFiles.FullName
  Compress-Archive -Path $foundFilePaths -DestinationPath "$outputZip\data.zip"

  Write-Host "Zip file created: $outputZip\data.zip"
  } else {
      Write-Host "No files found with the specified extensions."
  }