T1005 Data from Local System — Attack Simulation

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Find and dump sqlite databases (Linux)
linux automated bash
Procedure 00cbb875-7ae4-4cf1-b638-e543fd825300; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Copy Apple Notes database files using AppleScript
macos automated sh
Procedure cfb6d400-a269-4c06-a347-6d88d584d5f7; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Search files of interest and save them to a single zip file (Windows)
windows automated powershell
Procedure d3d9af44-b8ad-4375-8b0a-4bff4b7e419c; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows collection isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate technique source_mapped

Detection and collection

T1005 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.