Data from Local System

Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Adversaries may do this using a Command and Scripting Interpreter, such as cmd, which has functionality to interact with the file system to gather information. Some adversaries may also use Automated Collection on the local system.

ID: T1005

Sub-techniques: No sub-techniques

Tactic: Collection

Platforms: Linux, Windows, macOS

System Requirements: Privileges to access certain files and directories

Data Sources: File monitoring, Process command-line parameters, Process monitoring

Version: 1.2

Created: 31 May 2017

Last Modified: 26 May 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT1	APT1 has collected files from a local victim.^[1]
APT28	APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.^[2]^[3]
APT3	APT3 will identify Microsoft Office documents on the victim's computer.^[4]
APT37	APT37 has collected data from victims' local systems.^[5]
APT39	APT39 has used a tool to steal files from the compromised host.^[6]
BADNEWS	When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.^[7]^[8]
BadPatch	BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.^[9]
Bankshot	Bankshot collects files from the local system.^[10]
BRONZE BUTLER	BRONZE BUTLER has exfiltrated files stolen from local systems.^[11]
Calisto	Calisto can collect data from user directories.^[12]
China Chopper	China Chopper's server component can upload local files.^[13]^[14]^[15]
Cobalt Strike	Cobalt Strike can collect data from a local system.^[16]
CookieMiner	CookieMiner has retrieved iPhone text messages from iTunes phone backup files.^[17]
CosmicDuke	CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.^[18]
Cryptoistic	Cryptoistic can retrieve files from the local file system.^[19]
Dark Caracal	Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.^[20]
Dragonfly 2.0	Dragonfly 2.0 collected data from local victim systems.^[21]
Drovorub	Drovorub can transfer files from the victim machine.^[22]
Dust Storm	Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.^[23]
FatDuke	FatDuke can copy files and directories from a compromised host.^[24]
FIN6	FIN6 has collected and exfiltrated payment card data from compromised systems.^[25]^[26]^[27]
FLASHFLOOD	FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.^[28]
Forfiles	Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).^[2]
FrameworkPOS	FrameworkPOS can collect elements related to credit card data from process memory.^[29]
Frankenstein	Frankenstein has enumerated hosts via Empire, gathering various local system information.^[30]
Gamaredon Group	Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.^[31]
Goopy	Goopy has the ability to exfiltrate documents from infected systems.^[32]
GravityRAT	GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.^[33]
Honeybee	Honeybee collects data from the local victim system.^[34]
Hydraq	Hydraq creates a backdoor through which remote attackers can read data from files.^[35]^[36]
Inception	Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.^[37]
InvisiMole	InvisiMole can collect data from the system, and can monitor changes in specified directories.^[38]
Ixeshe	Ixeshe can collect data from a local system.^[39]
Kazuar	Kazuar uploads files from a specified directory to the C2 server.^[40]
Ke3chang	Ke3chang gathered information and files from local directories for exfiltration.^[41]
Kimsuky	Kimsuky has collected Office, PDF, and HWP documents from its victims.^[42]
Koadic	Koadic can download files off the target system to send back to the server.^[43]
Lazarus Group	Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers. Lazarus Group malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.^[44]^[45]^[46] Lazarus Group has used wevtutil to export Window security event logs.^[47]
LightNeuron	LightNeuron can collect files from a local system.^[48]
Linfo	Linfo creates a backdoor through which remote attackers can obtain data from local systems.^[49]
Machete	Machete searches the File system for files of interest.^[50]
MCMD	MCMD has the ability to upload files from an infected device.^[51]
menuPass	menuPass has collected various files from the compromised computers.^[52]
MobileOrder	MobileOrder exfiltrates data collected from the victim mobile device.^[53]
njRAT	njRAT can collect data from a local system.^[54]
Pasam	Pasam creates a backdoor through which remote attackers can retrieve files.^[55]
Patchwork	Patchwork collected and exfiltrated files from the infected system.^[56]
Pillowmint	Pillowmint has collected credit card data using native API functions.^[57]
PinchDuke	PinchDuke collects user files from the compromised host based on predefined file extensions.^[58]
PoisonIvy	PoisonIvy creates a backdoor through which remote attackers can steal system information.^[59]
PowerSploit	PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.^[60]^[61]
POWERSTATS	POWERSTATS can upload files from compromised hosts.^[62]
Proxysvc	Proxysvc searches the local system and gathers data.^[63]
PUNCHTRACK	PUNCHTRACK scrapes memory for properly formatted payment card data.^[64]^[65]
Ramsay	Ramsay can collect Microsoft Word documents from the target's filesystem.^[66]
RawPOS	RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.^[67]^[68]^[69]
ROKRAT	ROKRAT can request to upload collected host data and additional files.^[70]
Rover	Rover searches for files on local drives based on a predefined list of file extensions.^[71]
SDBot	SDBot has the ability to access the file system on a compromised host.^[72]
ShimRat	ShimRat has the capability to upload collected files to a C2.^[73]
Soft Cell	Soft Cell collected data from the victim's local system, including password hashes from the SAM hive in the Registry.^[74]
Stealth Falcon	Stealth Falcon malware gathers data from the local victim system.^[75]
Sunburst	Sunburst collected information from a compromised host.^[76]^[77]
TajMahal	TajMahal has the ability to steal documents from the local system including the print spooler queue.^[78]
Threat Group-3390	Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[79]
TrickBot	TrickBot collects local files and information from the victim’s local machine.^[80]
Turla	Turla RPC backdoors can upload files from victim machines.^[81]
UNC2452	UNC2452 extracted files from compromised networks.^[82]
Ursnif	Ursnif has collected files from victim machines, including certificates and cookies.^[83]
USBferry	USBferry can collect information from an air-gapped host machine.^[84]
WellMail	WellMail can exfiltrate files from the victim machine.^[85]
WellMess	WellMess can send files from the victim machine to C2.^[86]^[87]
yty	yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.^[88]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Data from Local System

Procedure Examples

Mitigations

Detection

References