T1005: Data from Local System
AI Answer
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to (Source: MITRE ATT&CK T1005)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1005 |
| Name | Data from Local System |
| Tactic | Collection (collection) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Data from Local System (T1005) is one of the highest-connectivity ATT&CK techniques: 230 MITRE STIX relationships reference this technique; 46 threat groups observed using it; 169 software families associated; 15 campaigns associated; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1005). Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.
Detection
DET0380 Detection of Local Data Collection Prior to Exfiltration AN1070 Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging. AN1071 Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys. AN1072 Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents. AN1073 Collection of device configuration via CLI commands (e.g., show running-config , copy flash , more ), often followed by TFTP/SCP transfers. AN1074 Adversaries accessing datastore or configuration files via vim-cmd , esxcli , or SCP to extract logs, VMs, or host configurations.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1005).
Mitigation
Data Loss Prevention (DLP) involves implementing strategies and technologies to identify, categorize, monitor, and control the movement of sensitive data within an organization. This includes protecting data formats indicative of Personally Identifiable Information (PII), intellectual property, or financial data from unauthorized access, transmission, or exfiltration. DLP solutions integrate with network, endpoint, and cloud platforms to enforce security policies and prevent accidental or malicious data leaks. (Citation: PurpleSec Data Loss Prevention) This mitigation can be implemented through the following measures:
Sensitive Data Categorization:
- Use Case: Identify and classify data based on sensitivity (e.g., PII, financial data, trade secrets).
- Implementation: Use DLP solutions to scan and tag files containing sensitive information using predefined patterns, such as Social Security Numbers or credit card details.
Exfiltration Restrictions:
- Use Case: Prevent unauthorized transmission of sensitive data.
- Implementation: Enforce policies to block unapproved email attachments, unauthorized USB usage, or unencrypted data uploads to cloud storage.
Data-in-Transit Monitoring:
- Use Case: Detect and prevent the transmission of sensitive data over unapproved channels.
- Implementation: Deploy network-based DLP tools to inspect outbound traffic for sensitive content (e.g., financial records or PII) and block unapproved transmissions.
Endpoint Data Protection:
- Use Case: Monitor and control sensitive data usage on endpoints.
- Implementation: Use endpoint-based DLP agents to block copy-paste actions of sensitive data and unauthorized printing or file sharing.
Cloud Data Security:
- Use Case: Protect data stored in cloud platforms.
- Implementation: Integrate DLP with cloud storage platforms like Google Drive, OneDrive, or AWS to monitor and restrict sensitive data sharing or downloads.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- TrickBot
- BLINDINGCAN
- RCSession
- QuietSieve
- Bumblebee
- BRICKSTORM
- Amadey
- Proxysvc
- yty
- KOPILUWAK
- Sardonic
- Misdat
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- GALLIUM
- APT3
- Kimsuky
- Volt Typhoon
- Patchwork
- APT41
- Dragonfly
- menuPass
- HAFNIUM
- FIN6
- Gamaredon Group
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- SharePoint ToolShell Exploitation
- Frankenstein
- Operation Honeybee
- Operation MidnightEclipse
- Cutting Edge
- Anthropic AI-orchestrated Campaign
- C0015
- SolarWinds Compromise
- Operation CuckooBees
- Night Dragon
- Operation Wocao
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
- https://attack.mitre.org/techniques/T1005
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_protocols_through_showmon.html#wp2760878733
- https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
- https://www.us-cert.gov/ncas/alerts/TA18-106A
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1005 Data from Local System. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1005 Data from Local System?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.