{"id":"T1005","name":"Data from Local System","url":"https://attack.mitre.org/techniques/T1005","tactics":["collection"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0380","stix_id":"x-mitre-detection-strategy--36bb5edf-e7b6-4d36-8ccc-1a18ddc573da","name":"Detection of Local Data Collection Prior to Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0380","analytics":[{"id":"AN1070","stix_id":"x-mitre-analytic--79ecfad5-3439-4a04-919a-236d47652ba0","name":"Analytic 1070","description":"Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.","url":"https://attack.mitre.org/detectionstrategies/DET0380#AN1070","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TargetFilePathRegex","description":"Allows tuning for file extensions or paths of sensitive data (e.g., *.xls, *.db, *.pdf)."},{"field":"ParentProcessFilter","description":"Used to scope monitoring to suspicious parent/child process trees like PowerShell or WMI spawning file reads."}],"live":true,"detection_strategies":["DET0380"],"techniques":["T1005"]},{"id":"AN1071","stix_id":"x-mitre-analytic--4f5f64b3-bc1b-4573-b790-42b8adfdd609","name":"Analytic 1071","description":"Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.","url":"https://attack.mitre.org/detectionstrategies/DET0380#AN1071","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"TimeWindow","description":"Time span to correlate multiple file access events indicative of scripted or bulk access."},{"field":"ScriptToolName","description":"List of tools (e.g., `find`, `grep`, `tar`, `scp`) that may be benign but are context-sensitive."}],"live":true,"detection_strategies":["DET0380"],"techniques":["T1005"]},{"id":"AN1072","stix_id":"x-mitre-analytic--a48f36c7-e946-4270-ae23-1a2e52ae2e24","name":"Analytic 1072","description":"Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.","url":"https://attack.mitre.org/detectionstrategies/DET0380#AN1072","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process:spawn","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"read/write","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"UserContext","description":"Useful for excluding known admin or scheduled jobs."},{"field":"TargetVolume","description":"Focus monitoring on removable drives or external paths."}],"live":true,"detection_strategies":["DET0380"],"techniques":["T1005"]},{"id":"AN1073","stix_id":"x-mitre-analytic--dfe1b67a-a1c1-43f4-a043-5784a315d018","name":"Analytic 1073","description":"Collection of device configuration via CLI commands (e.g., `show running-config`, `copy flash`, `more`), often followed by TFTP/SCP transfers.","url":"https://attack.mitre.org/detectionstrategies/DET0380#AN1073","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"command logging","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"}],"mutable_elements":[{"field":"CommandScope","description":"Defines list of configuration or diagnostic commands to monitor."},{"field":"AuthenticatedUserList","description":"Helps reduce false positives by whitelisting known admins."}],"live":true,"detection_strategies":["DET0380"],"techniques":["T1005"]},{"id":"AN1074","stix_id":"x-mitre-analytic--0abb4122-0795-46ef-b162-7570db42596a","name":"Analytic 1074","description":"Adversaries accessing datastore or configuration files via `vim-cmd`, `esxcli`, or SCP to extract logs, VMs, or host configurations.","url":"https://attack.mitre.org/detectionstrategies/DET0380#AN1074","platforms":["ESXi"],"log_source_references":[{"name":"esxis:vmkernel","channel":"Datastore Access","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"esxis-vmkernel"},{"name":"esxi:hostd","channel":"Command Execution","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"AccessPathRegex","description":"Regex for filtering targeted VM paths or files like *.vmdk, *.vmx."},{"field":"InteractiveShellUsage","description":"Tune to distinguish between interactive and script-driven data access."}],"live":true,"detection_strategies":["DET0380"],"techniques":["T1005"]}],"live":true,"version":"1.0","techniques":["T1005"]}],"sigma_rules":[{"id":"0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6","title":"Script Interpreter Spawning Credential Scanner - Windows","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.collection","attack.execution","attack.t1005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.007"],"cves":[]},{"id":"1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3","title":"ADFS Database Named Pipe Connection By Uncommon Tool","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2021-10-08","modified":"2023-11-30","description":"Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).\nUsed to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.\n","references":["https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml","https://o365blog.com/post/adfs/","https://github.com/Azure/SimuLand"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.collection","attack.t1005"],"path":"rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml","techniques":["T1005"],"cves":[]},{"id":"22777c9e-873a-4b49-855f-6072ab861a52","title":"OpenCanary - SMB File Open Request","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an SMB service on an OpenCanary node has had a file open request.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.lateral-movement","attack.collection","attack.t1021","attack.t1005"],"path":"rules/application/opencanary/opencanary_smb_file_open.yml","techniques":["T1021","T1005"],"cves":[]},{"id":"24c77512-782b-448a-8950-eddb0785fc71","title":"SQLite Chromium Profile Data DB Access","author":"TropChaud","status":"test","level":"high","date":"2022-12-19","modified":"2023-01-19","description":"Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.","references":["https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1539","attack.t1555.003","attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","techniques":["T1539","T1555.003","T1005"],"cves":[]},{"id":"2f47f1fd-0901-466e-a770-3b7092834a1b","title":"Potential Conti Ransomware Database Dumping Activity Via SQLCmd","author":"frack113","status":"test","level":"high","date":"2021-08-16","modified":"2023-05-04","description":"Detects a command used by conti to dump database","references":["https://twitter.com/vxunderground/status/1423336151860002816?s=20","https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection","https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1005","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml","techniques":["T1005"],"cves":[]},{"id":"4833155a-4053-4c9c-a997-777fcea0baa7","title":"SQLite Firefox Profile Data DB Access","author":"frack113","status":"test","level":"high","date":"2022-04-08","modified":"2023-01-19","description":"Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1539","attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml","techniques":["T1539","T1005"],"cves":[]},{"id":"54b9a76a-3c71-4673-b4b3-2edb4566ea7b","title":"AWS EC2 VM Export Failure","author":"Diogo Braz","status":"test","level":"low","date":"2020-04-16","modified":"2022-10-05","description":"An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.","references":["https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.collection","attack.t1005","attack.exfiltration","attack.t1537"],"path":"rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml","techniques":["T1005","T1537"],"cves":[]},{"id":"696bfb54-227e-4602-ac5b-30d9d2053312","title":"Veeam Backup Database Suspicious Query","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-04","modified":null,"description":"Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.","references":["https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml","techniques":["T1005"],"cves":[]},{"id":"6a69f62d-ce75-4b57-8dce-6351eb55b362","title":"Esentutl Steals Browser Information","author":"frack113","status":"test","level":"medium","date":"2022-02-13","modified":"2024-03-05","description":"One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe","references":["https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/","https://redcanary.com/threat-detection-report/threats/qbot/","https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml","techniques":["T1005"],"cves":[]},{"id":"882fbe50-d8d7-4e29-ae80-0648a8556866","title":"Crash Dump Created By Operating System","author":"Jason Mull","status":"experimental","level":"medium","date":"2025-05-12","modified":null,"description":"Detects \"BugCheck\" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.","references":["https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/","https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.credential-access","attack.collection","attack.t1003.002","attack.t1005"],"path":"rules/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml","techniques":["T1003.002","T1005"],"cves":[]},{"id":"b57ba453-b384-4ab9-9f40-1038086b4e53","title":"VeeamBackup Database Credentials Dump Via Sqlcmd.EXE","author":"frack113","status":"test","level":"high","date":"2021-12-20","modified":"2023-02-13","description":"Detects dump of credentials in VeeamBackup dbo","references":["https://thedfirreport.com/2021/12/13/diavol-ransomware/","https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml","techniques":["T1005"],"cves":[]},{"id":"cd072b25-a418-4f98-8ebc-5093fb38fe1a","title":"Cisco Collect Data","author":"Austin Clark","status":"test","level":"low","date":"2019-08-11","modified":"2023-01-04","description":"Collect pertinent data from the configuration files","references":["https://blog.router-switch.com/2013/11/show-running-config/","https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm","https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.credential-access","attack.collection","attack.t1087.001","attack.t1552.001","attack.t1005"],"path":"rules/network/cisco/aaa/cisco_cli_collect_data.yml","techniques":["T1087.001","T1552.001","T1005"],"cves":[]},{"id":"efd2eb09-b72e-4a61-8dc7-b1382a1e8983","title":"Shai-Hulud NPM Package Malicious Exfiltration via Curl","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-09-24","modified":null,"description":"Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.","references":["https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.exfiltration","attack.t1041","attack.collection","attack.t1005","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml","techniques":["T1041","T1005"],"cves":[]},{"id":"f0025a69-e1b7-4dda-a53c-db21fa2d4071","title":"Script Interpreter Spawning Credential Scanner - Linux","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.execution","attack.collection","attack.t1005","attack.t1059.004"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-48928","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-48927","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-0769","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-43200","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38950","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-38475","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-53150","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-48248","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-24991","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-22226","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-50302","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-0111","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-21418","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-55550","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-41713","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-5217","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4879","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-34102","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-23692","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-24919","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-4978","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-49103","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-4966","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-38831","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-36884","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-29256","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-26085","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2013-0629","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2017-11292","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-27104","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-27102","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-27101","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-27103","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2017-5638","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-3452","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-1653","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2018-0296","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-13608","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-8193","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-8195","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2020-8196","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-11634","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-5902","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-5591","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-26855","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}