T1005 Data from Local System
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- OpenCanary - SMB File Open Requesthightest · opencanary
- Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest · windows
- SQLite Chromium Profile Data DB Accesshightest · windows
- SQLite Firefox Profile Data DB Accesshightest · windows
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest · windows
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental · linux
- Script Interpreter Spawning Credential Scanner - Windowshighexperimental · windows
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental · linux
- ADFS Database Named Pipe Connection By Uncommon Toolmediumtest · windows
- Esentutl Steals Browser Informationmediumtest · windows
- Veeam Backup Database Suspicious Querymediumtest · windows
- Crash Dump Created By Operating Systemmediumexperimental · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.