Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Collection/ T1005

T1005Data from Local System

T1005 — Data from Local System is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 25 detection use cases covering it and 55 threat-intel articles citing it.

Collection
View on the matrix → Filter Detection Library MITRE official spec ↗
25Use cases
55Articles
0Sub-techniques
1Tactic

Use cases covering this technique (25)

Crypto-wallet file/keystore access by non-wallet process Internal actions · alerting DSΣP [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD Cisco ASA - Device File Copy Activity ESCU actions · hunting P Cisco ASA - Device File Copy to Remote Location ESCU actions · hunting P ESXi Sensitive Files Accessed ESCU actions · alerting P ESXi VM Exported via Remote Tool ESCU actions · alerting P PTC Windchill Gateway Command Execution ESCU actions · hunting P Sqlite Module In Temp Folder ESCU actions · alerting P Cisco TFTP Server Configuration for Data Exfiltration ESCU actions · alerting P [LLM] Still Sync Telegram tdata theft via non-Telegram process + SeBackupPrivilege abuse Bespoke actions · hunting DSΣPDDCS [LLM] Command line referencing Chrome Sync Data LevelDB passkey path (copy/stage for exfil) Bespoke actions · alerting DSΣPDDCS [LLM] anthropickit loot file '/tmp/runner_exfil.json' written to disk Bespoke actions · alerting DSΣPCS [LLM] Browser credential-store theft via OctLurk browser password decryptor Bespoke actions · hunting DSΣPCS [LLM] MySQL server (mysqld) writes exfil file via SELECT INTO OUTFILE on Budibase DB host Bespoke actions · hunting DSΣPCS [LLM] Siemens ROX II xz utility misused as cat to read root-owned secrets (CVE-2025-40948) Bespoke actions · hunting DSΣDD [LLM] CastleStealer/Starland RAT accessing browser credential stores and crypto wallets Bespoke actions · hunting DSΣPDDCS [LLM] Post-RCE read of DIRAC dirac.cfg / proxy / token stores on FileCatalog host Bespoke actions · hunting DSΣPDDCS [LLM] YesWiki credential access — web user reads wakka.config.php / .env / /etc/passwd Bespoke actions · hunting DSΣPDDCS [LLM] macOS.Gaslight keychain theft + collected_data.zip staging Bespoke actions · alerting DSΣPCS [LLM] Rust build script harvesting git commit diff (onering build.rs) Bespoke actions · alerting DSΣPDDCS [LLM] Node/npm/Bun process enumerating cloud, wallet, AI, and messaging credential file paths Bespoke actions · hunting DSPDDCS [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets Bespoke actions · alerting DSΣPDDCS [LLM] Pistache binary theft via /doc/../../proc/self/exe path traversal Bespoke actions · alerting SΣP [LLM] curl --path-as-is traversal command exfiltrating /proc/self/exe or /etc/passwd Bespoke exploit · alerting DSΣPDDCS [LLM] Successful sensitive-file disclosure via st traversal (/etc/passwd, package-lock.json) Bespoke actions · alerting SΣP

Articles citing this technique (55)

high Armored Likho expands its cyber-espionage toolkit art-62
crit IT threat evolution in Q2 2026. Non-mobile statistics art-99
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit [GHSA / CRITICAL] CVE-2026-73300: Budibase: SQL Injection via `multipleStatements: true` art-201
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-249
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit [GHSA / CRITICAL] CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval art-285
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
crit [GHSA / CRITICAL] CVE-2026-52778: YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service art-305
high Everybody's shipping code they can't read art-345
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high npm v12 delivers one of the biggest security improvements in years art-385
crit Compromised Rust crate onering performs code exfiltration art-392
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-398
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
crit Webworm: New burrowing techniques art-459
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high It's time to treat browser extensions like supply chain attack vectors art-522
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-546
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
crit Sednit reloaded: Back in the trenches art-629
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
high 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII art-704
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
high Lottie Player npm package compromised for crypto wallet theft art-1191
high Fetch the Flag CTF 2022 writeup: Not So Smart Fridge art-1945
high Snyking in - Directory traversal vulnerability exploit in the st package art-3583