Skip to content
Sign In
Learn

T1005

Data from Local System

What it is

Attackers search a compromised host's own disks for files worth taking: documents, configuration files with passwords, databases and source code. It is a technique under the Collection tactic. It is often the first collection an attacker does, because the host they are already on is the easiest place to look.

How adversaries use it

The attacker searches folders for file types and keywords, with built-in commands such as findstr or dir, PowerShell, or their own tools. They read what they find directly, or copy it to a staging folder to take out later. On servers they target application folders, configuration files and local databases.

Detect it in Elastic

Data source: Windows process creation events; Windows Security file access events

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) when the search command starts process.command_line: what was searched for and where event.code: 4663 when an audited file is read (Audit File System, on folders with auditing set) winlog.event_data.ObjectName: the file that was read process.executable: the program that read it (winlog.event_data.ProcessName when shipped by Winlogbeat) winlog.event_data.SubjectUserName: the account that read it host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-307.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "findstr.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "findstr /s /i /m connstr E:\\Depot\\*.cfg"
  },
  "@timestamp": "2026-06-02T14:30:16.584Z"
}

Prebuilt Elastic rule: Accessing Outlook Data Files

Hunt guidance

4663 is recorded only for folders that have file auditing set, so most hosts won't have it. Start with searches across many files: process.name: "findstr.exe" and process.command_line: */s*. Then, where file auditing is on, look for one process reading many files in a sensitive folder within minutes: event.code: 4663, grouped by process.executable. Look for searches for password or connection strings, reads by a script host or an unusual program, and reads that are followed by staging or an archive.

Ruling out legitimate activity

Antivirus, backup, indexing and developer tools read large numbers of files every day, usually under service accounts. Check the program, the account and the folder against what that host normally does. Keyword searches through configuration files by an interactive account deserve a closer look.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.