Log in Request a demo

Attack technique

Data from Local System

Data from local system is when an attacker searches a computer they already control to find files and other data worth taking.

In short

Data from local system is when an attacker searches a computer they already control to find files and other data worth taking. This usually happens before the data is sent out of the network. It can cover documents, settings files, databases and more.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Collection · Step 12 Of 15 In The Attack Chain

  1. MITRE IDT1005ATT&CK technique
  2. Detection4ways to spot itLook for broad file searching · Detection strategy MITRE lists
  3. Defences1ways to stop itUse data loss prevention

How it works

Once an attacker is on a system, they look through what is stored there. MITRE lists sources such as file systems, configuration files, local databases, virtual machine files and process memory.

They may use a command interpreter, or the command line on a network device, to browse the file system and gather information. They may also use automated collection to do this on the local system.

The goal is to find files of interest and sensitive data before exfiltration, which is the step where data leaves the organization.

A real example

Procedure examples listed by MITRE ATT&CK:

  • Action RAT can collect local data from an infected machine.
  • AuTo Stealer can collect PowerPoint, Word, Excel, PDF, text, database and image files from an infected machine.
  • BADNEWS crawls the local drives when it first starts and collects documents with extensions such as .doc, .docx, .pdf, .ppt, .pptx and .txt.
  • Amadey can collect information from a compromised host.
  • AppleSeed can collect data on a compromised host.

How to detect

  1. Look for broad file searching

    Watch for scripts or tools that list files across many folders, read selected files, and copy them to temporary locations.

  2. Watch scripted access on all platforms

    On Windows, Linux and macOS, look for shell or scripting activity that searches user folders, configuration files or key material.

  3. Watch device and server configuration reads

    On network devices and virtualization hosts, look for commands that read configuration or datastore files, especially when followed by a file transfer.

  4. Detection strategy MITRE lists

    DET0380, Detection of Local Data Collection Prior to Exfiltration.

How to defend

  1. Use data loss prevention

    Data loss prevention tools can restrict access to sensitive data and find sensitive data that is stored unencrypted.

Questions

What is Data from Local System (T1005)?

Data from Local System is a Collection technique where an attacker searches a computer they already control for files and other data worth taking. It usually happens before the data is sent out of the network, which is the step called exfiltration.

What data do attackers look for on a local system?

MITRE lists sources such as file systems, configuration files, local databases, virtual machine files and process memory. Attackers may use a command interpreter, or the command line on a network device, to browse the file system and gather information.

How can I detect Data from Local System?

Watch for scripts or tools that list files across many folders, read selected files and copy them to temporary locations. Look for shell or scripting activity that searches user folders, configuration files or key material, and for configuration reads followed by a file transfer.

How can I defend against Data from Local System?

Use data loss prevention tools, which can restrict access to sensitive data and find sensitive data that is stored unencrypted. Also monitor for broad file searching so collection is noticed before the data leaves the organization.

In our research

  1. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  2. [Research Summary]: Mystic Stealer December 2023
  3. [Research Summary]: Snatch Ransomware December 2023
  4. Echida Stealer Technical Analysis November 2023
  5. Most Common Attack Vectors & Ransomware Threat Relation October 2022
  6. Fancy Bear APT Group August 2022

Sources

  1. MITRE ATT&CK T1005: Data from Local System MITRE
  2. MITRE ATT&CK Collection (TA0009) MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

[Research Summary]: Mystic Stealer

Mystic Stealer is a stealer malware that first surfaced in April 2023. See what it steals, how it is sold as a service, and…

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more