T1005 Data from Local System
EnterpriseAdversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.
01
platforms
Platforms this applies to.
ESXiLinuxmacOSNetwork DevicesWindows
02
tactics
ATT&CK tactics this technique serves.
03
mitigations
ATT&CK mitigations that reduce this.
04
detected by (4)
Data components that detect this.
05
countered by (D3FEND)
D3FEND countermeasures that counter this.
Isolate
Deceive
Restore
06
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.DSData Securitystrong · backed by 8 of 13 mapped controls
- PR.AAIdentity Management, Authentication, and Access Controlmoderate · backed by 4 of 13 mapped controls
- DE.CMContinuous Monitoringweak · backed by 2 of 13 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
07
mitigating controls (13)
Security controls that mitigate this.
08
known-exploited CVEs (46)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-43200US | —OT critical | KEV | ||
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, mac… | ||||
| CVE-2025-48928US | —OT critical | KEV | ||
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over H… | ||||
| CVE-2025-48927US | —OT critical | KEV | ||
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025. | ||||
| CVE-2025-24991US | —OT critical | KEV | ||
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2025-22226US | medium6.0OT critical | KEV | ||
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a vir… | ||||
| CVE-2024-48248US | high8.6OT critical | KEV | ||
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the… | ||||
| CVE-2025-0111US | medium6.5OT critical | KEV | ||
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read fil… | ||||
| CVE-2025-21418US | —OT critical | KEV | ||
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||||
| CVE-2024-53150US | high7.1OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
The current USB-audio driver code doesn't… | ||||
| CVE-2024-55550US | low2.7OT critical | KEV | ||
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successfu… | ||||
| CVE-2024-50302US | medium5.5OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
HID: core: zero-initialize the report buffer
Since the report buffer is used by all kinds of drivers in variou… | ||||
| CVE-2024-41713US | critical9.1OT critical | KEV | ||
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path travers… | ||||
| CVE-2024-5217US | critical9.8OT critical | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a… | ||||
| CVE-2024-4879US | critical9.8OT critical | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthentica… | ||||
| CVE-2024-38475US | critical9.1OT critical | KEV | ||
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the se… | ||||
| CVE-2024-34102US | —OT critical | KEV | ||
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could re… | ||||
| CVE-2024-23692US | critical9.8OT critical | KEV | ||
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to exe… | ||||
| CVE-2024-24919US | high8.6OT critical | KEV | ||
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Sof… | ||||
| CVE-2024-4978US | high8.4OT critical | KEV | ||
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor m… | ||||
| CVE-2024-0769US | critical9.8OT critical | KEV | ||
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file… | ||||
09
attack patterns (4)
CAPEC attack patterns that exploit this.
10
groups (47)
Threat groups associated with this.
11
software (174)
Malware and tools associated with this.
12
campaigns (15)
Campaigns that use this.
13
Detected by (Sigma) (14)
Sigma detection rules related to this.
14
source
Where this definition is published.