T1005 Data from Local System
EnterpriseAdversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.
01
Plattformen
Plattformen, für die dies gilt.
ESXiLinuxmacOSNetwork DevicesWindows
02
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
03
Gegenmaßnahmen
ATT&CK-Gegenmaßnahmen, die dies verringern.
04
Erkannt durch (4)
Datenkomponenten, die dies erkennen.
05
Abgewehrt durch (D3FEND)
D3FEND-Gegenmaßnahmen dagegen.
Isolate
Deceive
Restore
06
NIST CSF 2.0 — Relevanzbereiche (Protect / Detect)
NIST-CSF-2.0-Bereiche mit dem größten Bezug (belegbasiert).
- PR.DSData Securitystark · gestützt durch 8 von 13 zugeordneten Controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderat · gestützt durch 4 von 13 zugeordneten Controls
- DE.CMContinuous Monitoringschwach · gestützt durch 2 von 13 zugeordneten Controls
Abgeleitet aus MITRE CTID (Apache-2.0) und dem NIST-800-53-↔-CSF-Crosswalk (gemeinfrei). Eine indikative Relevanz entlang der Protect-/Detect-Achse — keine Compliance-Bewertung und keine Abdeckungsaussage.
07
Mindernde Maßnahmen (13)
Sicherheitskontrollen, die dies mindern.
08
bekannt ausgenutzte CVEs (46)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-43200US | —OT kritisch | KEV | ||
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, mac… | ||||
| CVE-2025-48928US | —OT kritisch | KEV | ||
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over H… | ||||
| CVE-2025-48927US | —OT kritisch | KEV | ||
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. | ||||
| CVE-2025-24991US | —OT kritisch | KEV | ||
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2025-22226US | medium6.0OT kritisch | KEV | ||
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a vir… | ||||
| CVE-2024-48248US | high8.6OT kritisch | KEV | ||
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the… | ||||
| CVE-2025-0111US | medium6.5OT kritisch | KEV | ||
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read fil… | ||||
| CVE-2025-21418US | —OT kritisch | KEV | ||
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||||
| CVE-2024-53150US | high7.1OT kritisch | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't… | ||||
| CVE-2024-55550US | low2.7OT kritisch | KEV | ||
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successfu… | ||||
| CVE-2024-50302US | medium5.5OT kritisch | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
HID: core: zero-initialize the report buffer
Since the report buffer is used by all kinds of drivers in variou… | ||||
| CVE-2024-41713US | critical9.1OT kritisch | KEV | ||
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path travers… | ||||
| CVE-2024-5217US | critical9.8OT kritisch | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a… | ||||
| CVE-2024-4879US | critical9.8OT kritisch | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthentica… | ||||
| CVE-2024-38475US | critical9.1OT kritisch | KEV | ||
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the se… | ||||
| CVE-2024-34102US | —OT kritisch | KEV | ||
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could re… | ||||
| CVE-2024-23692US | critical9.8OT kritisch | KEV | ||
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to exe… | ||||
| CVE-2024-24919US | high8.6OT kritisch | KEV | ||
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Sof… | ||||
| CVE-2024-4978US | high8.4OT kritisch | KEV | ||
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor m… | ||||
| CVE-2024-0769US | critical9.8OT kritisch | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file… | ||||
09
Angriffsmuster (4)
CAPEC-Angriffsmuster, die dies ausnutzen.
10
Gruppen (47)
Zugehörige Bedrohungsgruppen.
11
Software (174)
Zugehörige Malware und Tools.
12
Kampagnen (15)
Kampagnen, die dies verwenden.
13
Erkannt durch (Sigma) (14)
Zugehörige Sigma-Erkennungsregeln.
14
Quelle
Wo diese Definition veröffentlicht ist.