T1005 — Data from Local System

Tactic: Collection · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as…

Sigma detection rules (5)

title: T1005 Data from Local System
id: a13ad5f2-7b3f-4877-a5aa-33279136beec
description: 'Detection of Local Data Collection Prior to Exfiltration. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TargetFilePathRegex, ParentProcessFilter.'
references:
  - https://attack.mitre.org/techniques/T1005
author: Shahrukh Khan
date: 2026-02-17
license: MIT
tags:
  - attack.collection
  - attack.t1005

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'

  selection_archive_ext:
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.tar'
      - '.gz'

  selection_staging_path:
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\ProgramData\'

  selection_interpreter:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and (selection_archive_ext or (selection_staging_path and selection_interpreter)) and not filter_system_account

falsepositives:
  - Legitimate backup/archival scripts writing to temp/staging directories, or users manually zipping files; tune TargetFilePathRegex/ParentProcessFilter against known backup tooling if noise remains.

level: medium

title: T1005 Data from Local System
id: be2fe9d1-f6ac-4375-9594-f11e68172659
description: 'Detection of Local Data Collection Prior to Exfiltration. The sensitive-keyword check previously only inspected a1, assuming the term was the first argument to find, but real invocations commonly place the search root first (e.g. find / -iname) with the sensitive pattern in a later -name/-path/-iname argument; the keyword is now matched across a1 through a4. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, ScriptToolName.'
references:
  - https://attack.mitre.org/techniques/T1005
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.collection
  - attack.t1005

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/find'
  selection_sensitive:
    - a1|contains:
        - '.ssh'
        - '.aws'
        - 'id_rsa'
        - '.docker'
    - a2|contains:
        - '.ssh'
        - '.aws'
        - 'id_rsa'
        - '.docker'
    - a3|contains:
        - '.ssh'
        - '.aws'
        - 'id_rsa'
        - '.docker'
    - a4|contains:
        - '.ssh'
        - '.aws'
        - 'id_rsa'
        - '.docker'
  condition: selection and selection_sensitive

falsepositives:
  - Routine administrative or backup scripts that enumerate credential-adjacent paths; auditd argv matching alone can't distinguish attacker recon from legitimate inventory tooling.

level: medium

title: T1005 Data from Local System
id: cf376f2e-dde6-4485-8e4f-7c166280841b
description: 'Detection of Local Data Collection Prior to Exfiltration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TargetVolume.'
references:
  - https://attack.mitre.org/techniques/T1005
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.collection
  - attack.t1005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/tar'
      - '/zip'
      - '/ditto'
  selection_paths:
    CommandLine|contains:
      - '/Users/'
      - '/Documents'
      - '~/Library'
  filter_backup:
    ParentImage|endswith: '/Time Machine'
  condition: selection and selection_paths and not filter_backup

falsepositives:
  - Scheduled backup or migration scripts that archive whole user directories as part of routine IT operations.

level: medium

title: T1005 Data from Local System
id: ee67bd68-6511-405a-8b92-ab196568d371
description: 'Detection of Local Data Collection Prior to Exfiltration. Dropped the unconstrained "tar czf" selector (archival/staging behavior belongs to the T1560/T1074 staging rule, not T1005) and scoped the "locate" selector to sensitive search targets (credentials, keys, config files) instead of firing on any locate invocation. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandScope, AuthenticatedUserList.'
references:
  - https://attack.mitre.org/techniques/T1005
author: Shahrukh Khan
date: 2026-02-20
license: MIT
tags:
  - attack.collection
  - attack.t1005

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_find:
    type: EXECVE
    a0|endswith: '/find'
    a1: '/'
    a2|contains: '-name'
  selection_locate:
    type: EXECVE
    a0|endswith: '/locate'
    a1|contains:
      - 'passwd'
      - 'shadow'
      - 'id_rsa'
      - 'id_ed25519'
      - '.pem'
      - '.key'
      - 'credentials'
      - '.env'
      - 'config'
      - 'wallet.dat'

  condition: 1 of selection_*

falsepositives:
  - Administrators or asset-inventory tooling searching for configuration files by name as part of routine audits.

level: medium

title: T1005 Data from Local System
id: 71c48ccf-6fb2-44a5-bdc6-348ef06e6654
description: 'Detection of Local Data Collection Prior to Exfiltration. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccessPathRegex, InteractiveShellUsage.'
references:
  - https://attack.mitre.org/techniques/T1005
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.collection
  - attack.t1005

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_copy:
    CommandLine|contains:
      - 'cp /vmfs/volumes/'
      - 'tar -cvf'
      - 'vim-cmd vmsvc/get.filelayoutex'
  selection_ssh:
    CommandLine|contains: 'scp '

  condition: 1 of selection_*

falsepositives:
  - Routine backup, migration, or support diagnostic bundle scripts run by administrators over SSH will trigger the same file copy and archive commands.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1005 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan