Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Collection/ T1005

T1005Data from Local System

T1005 — Data from Local System is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 28 detection use cases covering it and 65 threat-intel articles citing it.

Collection
View on the matrix → Filter Detection Library MITRE official spec ↗
28Use cases
65Articles
0Sub-techniques
1Tactic

Use cases covering this technique (28)

Crypto-wallet file/keystore access by non-wallet process Internal actions · alerting DSΣP [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD Cisco ASA - Device File Copy Activity ESCU actions · hunting P Cisco ASA - Device File Copy to Remote Location ESCU actions · hunting P ESXi Sensitive Files Accessed ESCU actions · alerting P ESXi VM Exported via Remote Tool ESCU actions · alerting P PTC Windchill Gateway Command Execution ESCU actions · hunting P Sqlite Module In Temp Folder ESCU actions · alerting P Cisco TFTP Server Configuration for Data Exfiltration ESCU actions · alerting P [LLM] Rails/libvips worker reading process environment or system secrets (CVE-2026-66066 file-read) Bespoke actions · alerting SΣPCS [LLM] File read/write/delete/rename performed by a goshs process (SFTP data access) Bespoke actions · hunting DSPDDCS [LLM] NightLedger recon: access to C:\Windows\debug\NetSetup.log by non-system process Bespoke actions · hunting DSPDDCS [LLM] MySQL server (mysqld) writes exfil file via SELECT INTO OUTFILE on Budibase DB host Bespoke actions · hunting DSΣPCS [LLM] BitLocker recovery key harvesting via manage-bde -protectors -get Bespoke actions · hunting DSΣPDDCS [LLM] Siemens ROX II xz utility misused as cat to read root-owned secrets (CVE-2025-40948) Bespoke actions · hunting DSΣDD [LLM] CastleStealer/Starland RAT accessing browser credential stores and crypto wallets Bespoke actions · hunting DSΣPDDCS [LLM] HelloExecutor recon enumerating ViPNet Client/Administrator Export key stores Bespoke recon · hunting DSΣPDDCS [LLM] Post-RCE read of DIRAC dirac.cfg / proxy / token stores on FileCatalog host Bespoke actions · hunting DSΣPDDCS [LLM] YesWiki credential access — web user reads wakka.config.php / .env / /etc/passwd Bespoke actions · hunting DSΣPDDCS [LLM] Cilium Envoy admin socket abuse: TLS secret / config disclosure via admin.sock (CVE-2026-49445) Bespoke actions · hunting DSΣPDDCS [LLM] macOS.Gaslight keychain theft + collected_data.zip staging Bespoke actions · alerting DSΣPCS [LLM] Rust build script harvesting git commit diff (onering build.rs) Bespoke actions · alerting DSΣPDDCS [LLM] Node/npm/Bun process enumerating cloud, wallet, AI, and messaging credential file paths Bespoke actions · hunting DSPDDCS [LLM] Non-browser process copying Chrome/Edge/Brave Login Data, Web Data, or wallet extension LevelDB state Bespoke actions · alerting DSΣPDDCS [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets Bespoke actions · alerting DSΣPDDCS [LLM] Pistache binary theft via /doc/../../proc/self/exe path traversal Bespoke actions · alerting SΣP [LLM] curl --path-as-is traversal command exfiltrating /proc/self/exe or /etc/passwd Bespoke exploit · alerting DSΣPDDCS [LLM] Successful sensitive-file disclosure via st traversal (/etc/passwd, package-lock.json) Bespoke actions · alerting SΣP

Articles citing this technique (65)

crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
crit [GHSA / CRITICAL] CVE-2026-62325: goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) art-36
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit [GHSA / CRITICAL] GHSA-q6x4-v3qx-85qw: Budibase: SQL Injection via `multipleStatements: true` art-85
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-130
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-145
crit Begun, the Patch Wars have art-150
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-152
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
crit [GHSA / CRITICAL] CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval art-190
crit jscrambler npm package publishes malicious preinstall binary art-195
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
crit [GHSA / CRITICAL] CVE-2026-52778: YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service art-210
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit [GHSA / CRITICAL] CVE-2026-49445: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket art-240
high Everybody's shipping code they can't read art-295
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high npm v12 delivers one of the biggest security improvements in years art-339
crit Compromised Rust crate onering performs code exfiltration art-346
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-352
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-379
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-388
crit Laravel Lang Supply Chain Advisory art-399
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
crit Webworm: New burrowing techniques art-413
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-457
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high It's time to treat browser extensions like supply chain attack vectors art-477
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-501
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Aikido Attack finds multiple 0-days in Hoppscotch art-528
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
high Glassworm Strikes Popular React Native Phone Number Packages art-587
crit Sednit reloaded: Back in the trenches art-596
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
high 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII art-671
high npm Supply Chain Attack via Open Source maintainer compromise art-855
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-865
high Lottie Player npm package compromised for crypto wallet theft art-1168
high Fetch the Flag CTF 2022 writeup: Not So Smart Fridge art-1922
high Snyking in - Directory traversal vulnerability exploit in the st package art-3560