T1005 Data from Local System — Detection Rules

Source-backed rule directory

• OpenCanary - SMB File Open Request · test · high · {"category":"application","product":"opencanary"}
• AWS EC2 VM Export Failure · test · low · {"product":"aws","service":"cloudtrail"}
• Script Interpreter Spawning Credential Scanner - Linux · experimental · high · {"category":"process_creation","product":"linux"}
• Cisco Collect Data · test · low · {"product":"cisco","service":"aaa"}
• Crash Dump Created By Operating System · experimental · medium · {"product":"windows","service":"system"}
• ADFS Database Named Pipe Connection By Uncommon Tool · test · medium · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• Esentutl Steals Browser Information · test · medium · {"category":"process_creation","product":"windows"}
• Veeam Backup Database Suspicious Query · test · medium · {"category":"process_creation","product":"windows"}
• VeeamBackup Database Credentials Dump Via Sqlcmd.EXE · test · high · {"category":"process_creation","product":"windows"}
• SQLite Chromium Profile Data DB Access · test · high · {"category":"process_creation","product":"windows"}
• SQLite Firefox Profile Data DB Access · test · high · {"category":"process_creation","product":"windows"}
• Script Interpreter Spawning Credential Scanner - Windows · experimental · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1005 Data from Local System

COUNT(reads_of_protected_files BY process_or_user, 10m) >= threshold -> ALERT

• File-System Activity Logs
• Storage-System Audit Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0380 Detection of Local Data Collection Prior to Exfiltration

AN1070 Analytic 1070

Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

AN1071 Analytic 1071

Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

AN1072 Analytic 1072

Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

AN1073 Analytic 1073

Collection of device configuration via CLI commands (e.g., `show running-config`, `copy flash`, `more`), often followed by TFTP/SCP transfers.

AN1074 Analytic 1074

Adversaries accessing datastore or configuration files via `vim-cmd`, `esxcli`, or SCP to extract logs, VMs, or host configurations.