T1005 Data from Local System
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. MITRE ATT&CK
2 programs on CmdID 9 Sigma rules T1005 on attack.mitre.org
Programs for it
Sigma rules tagged with it
highScript Interpreter Spawning Credential Scanner - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux
highScript Interpreter Spawning Credential Scanner - WindowsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highShai-Hulud NPM Package Malicious Exfiltration via CurlSwachchhanda Shrawan Poudel (Nextron Systems) · Linux