T1005 Data from Local System
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- OpenCanary - SMB File Open Requesthightest · opencanary
- Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest · windows
- SQLite Chromium Profile Data DB Accesshightest · windows
- SQLite Firefox Profile Data DB Accesshightest · windows
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest · windows
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental · linux
- Script Interpreter Spawning Credential Scanner - Windowshighexperimental · windows
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental · linux
- ADFS Database Named Pipe Connection By Uncommon Toolmediumtest · windows
- Esentutl Steals Browser Informationmediumtest · windows
- Veeam Backup Database Suspicious Querymediumtest · windows
- Crash Dump Created By Operating Systemmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.