Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Данные из локальной системы

Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use Automated Collection on the local system.

ID: T1005

Тактика(-и): Collection

Платформы: Linux, macOS, Network, Windows

Источники данных: Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution

Версия: 1.6

Дата создания: 31 May 2017

Последнее изменение: 12 Apr 2023

Название	Описание
Примеры процедур
Frankenstein	Frankenstein has enumerated hosts via Empire, gathering various local system information.(Citation: Talos Frankenstein June 2019)
Kimsuky	Kimsuky has collected Office, PDF, and HWP documents from its victims.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)
BRONZE BUTLER	BRONZE BUTLER has exfiltrated files stolen from local systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Proxysvc	Proxysvc searches the local system and gathers data.(Citation: McAfee GhostSecret)
Drovorub	Drovorub can transfer files from the victim machine.(Citation: NSA/FBI Drovorub August 2020)
Cryptoistic	Cryptoistic can retrieve files from the local file system.(Citation: SentinelOne Lazarus macOS July 2020)
xCaon	xCaon has uploaded files from victims' machines.(Citation: Checkpoint IndigoZebra July 2021)
LAPSUS$	LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.(Citation: MSTIC DEV-0537 Mar 2022)
APT39	APT39 has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)
QakBot	QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)
ccf32	ccf32 can collect files from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Dtrack	Dtrack can collect a variety of information from victim machines.(Citation: CyberBit Dtrack)
Bankshot	Bankshot collects files from the local system.(Citation: McAfee Bankshot)
BADNEWS	When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018)
HAFNIUM	HAFNIUM has collected data and files from a compromised machine.(Citation: Rapid7 HAFNIUM Mar 2021)
SVCReady	SVCReady can collect data from an infected host.(Citation: HP SVCReady Jun 2022)
Rising Sun	Rising Sun has collected data and files from a compromised host.(Citation: McAfee Sharpshooter December 2018)
PUNCHTRACK	PUNCHTRACK scrapes memory for properly formatted payment card data.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
China Chopper	China Chopper's server component can upload local files.(Citation: FireEye Periscope March 2018)(Citation: Lee 2013)(Citation: NCSC Joint Report Public Tools)(Citation: Rapid7 HAFNIUM Mar 2021)
Axiom	Axiom has collected data from a compromised network.(Citation: Novetta-Axiom)
Uroburos	Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Octopus	Octopus can exfiltrate files from the system using a documents collector tool.(Citation: ESET Nomadic Octopus 2018)
FLASHFLOOD	FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.(Citation: FireEye APT30)
Operation Wocao	Operation Wocao has exfiltrated files and directories of interest from the targeted system.(Citation: FoxIT Wocao December 2019)
P.A.S. Webshell	P.A.S. Webshell has the ability to copy files on a compromised host.(Citation: ANSSI Sandworm January 2021)
ToddyCat	ToddyCat has run scripts to collect documents from targeted hosts.(Citation: Kaspersky ToddyCat Check Logs October 2023)
Cobalt Strike	Cobalt Strike can collect data from a local system.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Cobalt Strike Manual 4.3 November 2020)
Windigo	Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)
GrimAgent	GrimAgent can collect data and files from a compromised host.(Citation: Group IB GrimAgent July 2021)
NightClub	NightClub can use a file monitor to steal specific files from targeted systems.(Citation: MoustachedBouncer ESET August 2023)
Nebulae	Nebulae has the capability to upload collected files to C2.(Citation: Bitdefender Naikon April 2021)
KONNI	KONNI has stored collected information and discovered processes in a tmp file.(Citation: Malwarebytes Konni Aug 2021)
WarzoneRAT	WarzoneRAT can collect data from a compromised host.(Citation: Check Point Warzone Feb 2020)
PingPull	PingPull can collect data from a compromised host.(Citation: Unit 42 PingPull Jun 2022)
PowerSploit	PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
	During Night Dragon, the threat actors collected files and other data from compromised systems.(Citation: McAfee Night Dragon)
RAPIDPULSE	RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.(Citation: Mandiant Pulse Secure Update May 2021)
Fox Kitten	Fox Kitten has searched local system resources to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Caterpillar WebShell	Caterpillar WebShell has a module to collect information from the local database.(Citation: ClearSky Lebanese Cedar Jan 2021)
Andariel	Andariel has collected large numbers of files from compromised network systems for later extraction.(Citation: FSI Andariel Campaign Rifle July 2017)
RedCurl	RedCurl has collected data from the local disk of compromised hosts.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
Amadey	Amadey can collect information from a compromised host.(Citation: BlackBerry Amadey 2020)
BLINDINGCAN	BLINDINGCAN has uploaded files from victim machines.(Citation: US-CERT BLINDINGCAN Aug 2020)
APT1	APT1 has collected files from a local victim.(Citation: Mandiant APT1)
GALLIUM	GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.(Citation: Cybereason Soft Cell June 2019)
SombRAT	SombRAT has collected data and files from a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021)
APT29	APT29 has stolen data from compromised hosts.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Lazarus Group	Lazarus Group has collected data and files from compromised networks.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: Kaspersky ThreatNeedle Feb 2021)
Ramsay	Ramsay can collect Microsoft Word documents from the target's file system, as well as `.txt`, `.doc`, and `.xls` files from the Internet Explorer cache.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Raccoon Stealer	Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)
MarkiRAT	MarkiRAT can upload data from the victim's machine to the C2 server.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Gamaredon Group	Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.(Citation: ESET Gamaredon June 2020)
Agrius	Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.(Citation: Unit42 Agrius 2023)
OutSteel	OutSteel can collect information from a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
WellMess	WellMess can send files from the victim machine to C2.(Citation: PWC WellMess July 2020)(Citation: CISA WellMess July 2020)
FIN6	FIN6 has collected and exfiltrated payment card data from compromised systems.(Citation: Trend Micro FIN6 October 2019)(Citation: RiskIQ British Airways September 2018)(Citation: RiskIQ Newegg September 2018)
Latrodectus	Latrodectus can collect data from a compromised host using a stealer module.(Citation: Bitsight Latrodectus June 2024)
Aquatic Panda	Aquatic Panda captured local Windows security event log data from victim machines using the `wevtutil` utility to extract contents to an `evtx` output file.(Citation: Crowdstrike HuntReport 2022)
Mafalda	Mafalda can collect files and information from a compromised host.(Citation: SentinelLabs Metador Sept 2022)
SysUpdate	SysUpdate can collect information and files from a compromised host.(Citation: Lunghi Iron Tiger Linux)
yty	yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.(Citation: ASERT Donot March 2018)
Bumblebee	Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.(Citation: Cybereason Bumblebee August 2022)
EnvyScout	EnvyScout can collect sensitive NTLM material from a compromised host.(Citation: MSTIC Nobelium Toolset May 2021)
APT29	APT29 has extracted files from compromised networks.(Citation: Volexity SolarWinds)
	During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.(Citation: FoxIT Wocao December 2019)
Turla	Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019)
Hydraq	Hydraq creates a backdoor through which remote attackers can read data from files.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
SUNBURST	SUNBURST collected information from a compromised host.(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: FireEye SUNBURST Backdoor December 2020)
FoggyWeb	FoggyWeb can retrieve configuration data from a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
Cyclops Blink	Cyclops Blink can upload files from a compromised host.(Citation: NCSC Cyclops Blink February 2022)
PowerLess	PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.(Citation: Cybereason PowerLess February 2022)
APT41	APT41 has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021)
CHIMNEYSWEEP	CHIMNEYSWEEP can collect files from compromised hosts.(Citation: Mandiant ROADSWEEP August 2022)
DRATzarus	DRATzarus can collect information from a compromised host.(Citation: ClearSky Lazarus Aug 2020)
	During C0015, the threat actors obtained files and data from the compromised network.(Citation: DFIR Conti Bazar Nov 2021)
Sardonic	Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.(Citation: Symantec FIN8 Jul 2023)
MgBot	MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.(Citation: ESET EvasivePanda 2023)
BlackMould	BlackMould can copy files on a compromised host.(Citation: Microsoft GALLIUM December 2019)
MobileOrder	MobileOrder exfiltrates data collected from the victim mobile device.(Citation: Scarlet Mimic Jan 2016)
ZxShell	ZxShell can transfer files from a compromised host.(Citation: Talos ZxShell Oct 2014)
Bazar	Bazar can retrieve information from the infected machine.(Citation: Cybereason Bazar July 2020)
SpicyOmelette	SpicyOmelette has collected data and other information from a compromised host.(Citation: Secureworks GOLD KINGSWOOD September 2018)
SharpDisco	SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.(Citation: MoustachedBouncer ESET August 2023)
	During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020)
DanBot	DanBot can upload files from compromised hosts.(Citation: SecureWorks August 2019)
InvisiMole	InvisiMole can collect data from the system, and can monitor changes in specified directories.(Citation: ESET InvisiMole June 2018)
Crimson	Crimson can collect information from a compromised host.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
SLOTHFULMEDIA	SLOTHFULMEDIA has uploaded files and information from victim machines.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
AppleSeed	AppleSeed can collect data on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)
MacMa	MacMa can collect then exfiltrate files from the compromised system.(Citation: ESET DazzleSpy Jan 2022)
SLIGHTPULSE	SLIGHTPULSE can read files specified on the local system.(Citation: Mandiant Pulse Secure Zero-Day April 2021)
LuminousMoth	LuminousMoth has collected files and data from compromised machines.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)
APT37	APT37 has collected data from victims' local systems.(Citation: FireEye APT37 Feb 2018)
NPPSPY	NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.(Citation: Huntress NPPSPY 2022)
Flagpro	Flagpro can collect data from a compromised host, including Windows authentication information.(Citation: NTT Security Flagpro new December 2021)
Taidoor	Taidoor can upload data and files from a victim's machine.(Citation: TrendMicro Taidoor)
IceApple	IceApple can collect files, passwords, and other data from a compromised host.(Citation: CrowdStrike IceApple May 2022)
Misdat	Misdat has collected files and data from a compromised host.(Citation: Cylance Dust Storm)
Tomiris	Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.(Citation: Kaspersky Tomiris Sep 2021)
Dragonfly	Dragonfly has collected data from local victim systems.(Citation: US-CERT TA18-074A)
CURIUM	CURIUM has exfiltrated data from a compromised machine.(Citation: Microsoft Iranian Threat Actor Trends November 2021)
Shark	Shark can upload files to its C2.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
Woody RAT	Woody RAT can collect information from a compromised host.(Citation: MalwareBytes WoodyRAT Aug 2022)
XCSSET	XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.(Citation: trendmicro xcsset xcode project 2020)
Dust Storm	Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.(Citation: Cylance Dust Storm)
	During the SolarWinds Compromise, APT29 extracted files from compromised networks.(Citation: Volexity SolarWinds)
APT28	APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
BoxCaon	BoxCaon can upload files from a compromised host.(Citation: Checkpoint IndigoZebra July 2021)
Brute Ratel C4	Brute Ratel C4 has the ability to upload files from a compromised system.(Citation: Palo Alto Brute Ratel July 2022)
AuTo Stealer	AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)
SDBbot	SDBbot has the ability to access the file system on a compromised host.(Citation: Proofpoint TA505 October 2019)
QuasarRAT	QuasarRAT can retrieve files from compromised client machines.(Citation: CISA AR18-352A Quasar RAT December 2018)
Ursnif	Ursnif has collected files from victim machines, including certificates and cookies.(Citation: TrendMicro BKDR_URSNIF.SM)
Rover	Rover searches for files on local drives based on a predefined list of file extensions.(Citation: Palo Alto Rover)
FrameworkPOS	FrameworkPOS can collect elements related to credit card data from process memory.(Citation: SentinelOne FrameworkPOS September 2019)
	During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.(Citation: Mandiant APT41)
Calisto	Calisto can collect data from user directories.(Citation: Securelist Calisto July 2018)
TrickBot	TrickBot collects local files and information from the victim’s local machine.(Citation: S2 Grupo TrickBot June 2017)
Bisonal	Bisonal has collected information from a compromised host.(Citation: Talos Bisonal Mar 2020)
Inception	Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.(Citation: Kaspersky Cloud Atlas August 2019)
PcShare	PcShare can collect files and information from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Mongall	Mongall has the ability to upload files from victim's machines.(Citation: SentinelOne Aoqin Dragon June 2022)
IPsec Helper	IPsec Helper can identify specific files and folders for follow-on exfiltration.(Citation: SentinelOne Agrius 2021)
Ke3chang	Ke3chang gathered information and files from local directories for exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)
Patchwork	Patchwork collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork)
ThreatNeedle	ThreatNeedle can collect data and files from a compromised host.(Citation: Kaspersky ThreatNeedle Feb 2021)
DUSTTRAP	DUSTTRAP can gather data from infected systems.(Citation: Google Cloud APT41 2024)
APT3	APT3 will identify Microsoft Office documents on the victim's computer.(Citation: aptsim)
LightNeuron	LightNeuron can collect files from a local system.(Citation: ESET LightNeuron May 2019)
RawPOS	RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.(Citation: Kroll RawPOS Jan 2017)(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)
DnsSystem	DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.(Citation: Zscaler Lyceum DnsSystem June 2022)
Forfiles	Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).(Citation: Überwachung APT28 Forfiles June 2015)
FatDuke	FatDuke can copy files and directories from a compromised host.(Citation: ESET Dukes October 2019)
Dragonfly 2.0	Dragonfly 2.0 collected data from local victim systems.(Citation: US-CERT TA18-074A)
Kevin	Kevin can upload logs and other data from a compromised host.(Citation: Kaspersky Lyceum October 2021)
Wevtutil	Wevtutil can be used to export events from a specific log.(Citation: Wevtutil Microsoft Documentation)(Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
POWERSTATS	POWERSTATS can upload files from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)
SideTwist	SideTwist has the ability to upload files from a compromised host.(Citation: Check Point APT34 April 2021)
Green Lambert	Green Lambert can collect data from a compromised host.(Citation: Objective See Green Lambert for OSX Oct 2021)
metaMain	metaMain can collect files and system information from a compromised host.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Neoichor	Neoichor can upload files from a victim's machine.(Citation: Microsoft NICKEL December 2021)
Zox	Zox has the ability to upload files from a targeted system.(Citation: Novetta-Axiom)
DarkWatchman	DarkWatchman can collect files from a compromised host.(Citation: Prevailion DarkWatchman 2021)
Gelsemium	Gelsemium can collect data from a compromised host.(Citation: ESET Gelsemium June 2021)
Milan	Milan can upload files from a compromised host.(Citation: ClearSky Siamesekitten August 2021)
	During Operation Honeybee, the threat actors collected data from compromised hosts.(Citation: McAfee Honeybee)
LoFiSe	LoFiSe can collect files of interest from targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)
BADFLICK	BADFLICK has uploaded files from victims' machines.(Citation: Accenture MUDCARP March 2019)
CharmPower	CharmPower can collect data and files from a compromised host.(Citation: Check Point APT35 CharmPower January 2022)
UNC2452	UNC2452 extracted files from compromised networks.(Citation: Volexity SolarWinds)
Mis-Type	Mis-Type has collected files and data from a compromised host.(Citation: Cylance Dust Storm)
Out1	Out1 can copy files and Registry data from compromised hosts.(Citation: Trend Micro Muddy Water March 2021)
Threat Group-3390	Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)
CreepyDrive	CreepyDrive can upload files to C2 from victim machines.(Citation: Microsoft POLONIUM June 2022)
GravityRAT	GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.(Citation: Talos GravityRAT)
CookieMiner	CookieMiner has retrieved iPhone text messages from iTunes phone backup files.(Citation: Unit42 CookieMiner Jan 2019)
QuietSieve	QuietSieve can collect files from a compromised host.(Citation: Microsoft Actinium February 2022)
USBferry	USBferry can collect information from an air-gapped host machine.(Citation: TrendMicro Tropic Trooper May 2020)
	During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)
TinyTurla	TinyTurla can upload files from a compromised host.(Citation: Talos TinyTurla September 2021)
Machete	Machete searches the File system for files of interest.(Citation: ESET Machete July 2019)
	During Frankenstein, the threat actors used Empire to gather various local system information.(Citation: Talos Frankenstein June 2019)
FIN7	FIN7 has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Carbon Spider August 2021)
Pillowmint	Pillowmint has collected credit card data using native API functions.(Citation: Trustwave Pillowmint June 2020)
Goopy	Goopy has the ability to exfiltrate documents from infected systems.(Citation: Cybereason Cobalt Kitty 2017)
PoisonIvy	PoisonIvy creates a backdoor through which remote attackers can steal system information.(Citation: Symantec Darkmoon Aug 2005)
MCMD	MCMD has the ability to upload files from an infected device.(Citation: Secureworks MCMD July 2019)
Ember Bear	Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)
	During CostaRicto, the threat actors collected data and files from compromised networks.(Citation: BlackBerry CostaRicto November 2020)
RCSession	RCSession can collect data from a compromised host.(Citation: Profero APT27 December 2020)(Citation: Trend Micro DRBControl February 2020)
FunnyDream	FunnyDream can upload files from victims' machines.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: Kaspersky APT Trends Q1 2020)
Ixeshe	Ixeshe can collect data from a local system.(Citation: Trend Micro IXESHE 2012)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.(Citation: Trend Micro MacOS Backdoor November 2020)
Crutch	Crutch can exfiltrate files from compromised systems.(Citation: ESET Crutch December 2020)
Koadic	Koadic can download files off the target system to send back to the server.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
Stealth Falcon	Stealth Falcon malware gathers data from the local victim system.(Citation: Citizen Lab Stealth Falcon May 2016)
ROKRAT	ROKRAT can collect host data and specific file types.(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
APT38	APT38 has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)
FlawedAmmyy	FlawedAmmyy has collected information and files from a compromised machine.(Citation: Korean FSI TA505 2020)
Volt Typhoon	Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Linfo	Linfo creates a backdoor through which remote attackers can obtain data from local systems.(Citation: Symantec Linfo May 2012)
ShimRat	ShimRat has the capability to upload collected files to a C2.(Citation: FOX-IT May 2016 Mofang)
PinchDuke	PinchDuke collects user files from the compromised host based on predefined file extensions.(Citation: F-Secure The Dukes)
Chrommme	Chrommme can collect data from a local system.(Citation: ESET Gelsemium June 2021)
CosmicDuke	CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.(Citation: F-Secure Cosmicduke)
BadPatch	BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.(Citation: Unit 42 BadPatch Oct 2017)
esentutl	esentutl can be used to collect data from local file systems.(Citation: Red Canary 2021 Threat Detection Report March 2021)
Hikit	Hikit can upload files from compromised machines.(Citation: Novetta-Axiom)
ZxxZ	ZxxZ can collect data from a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)
menuPass	menuPass has collected various files from the compromised computers.(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020)
Wizard Spider	Wizard Spider has collected data from a compromised host prior to exfiltration.(Citation: Mandiant FIN12 Oct 2021)
Kazuar	Kazuar uploads files from a specified directory to the C2 server.(Citation: Unit 42 Kazuar May 2017)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve files.(Citation: Symantec Pasam May 2012)
KGH_SPY	KGH_SPY can send a file containing victim system information to C2.(Citation: Cybereason Kimsuky November 2020)
Magic Hound	Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)
TajMahal	TajMahal has the ability to steal documents from the local system including the print spooler queue.(Citation: Kaspersky TajMahal April 2019)
	During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.(Citation: Cybereason OperationCuckooBees May 2022)
Dark Caracal	Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.(Citation: Lookout Dark Caracal Jan 2018)
STARWHALE	STARWHALE can collect data from an infected local host.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
KOPILUWAK	KOPILUWAK can gather information from compromised hosts.(Citation: Mandiant Suspected Turla Campaign February 2023)
Clambling	Clambling can collect information from a compromised host.(Citation: Trend Micro DRBControl February 2020)
WellMail	WellMail can exfiltrate files from the victim machine.(Citation: CISA WellMail July 2020)
RainyDay	RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.(Citation: Bitdefender Naikon April 2021)
Honeybee	Honeybee collects data from the local victim system.(Citation: McAfee Honeybee)
StrifeWater	StrifeWater can collect data from a compromised host.(Citation: Cybereason StrifeWater Feb 2022)
Cobalt Strike	Cobalt Strike can collect data from a local system.(Citation: Cobalt Strike TTPs Dec 2017)
Bandook	Bandook can collect local files from the system .(Citation: CheckPoint Bandook Nov 2020)
Sandworm Team	Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Action RAT	Action RAT can collect local data from an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)
Pcexter	Pcexter can upload files from targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)
FIN13	FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
njRAT	njRAT can collect data from a local system.(Citation: Fidelis njRAT June 2013)
Samurai	Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.(Citation: Kaspersky ToddyCat June 2022)
Saint Bot	Saint Bot can collect files and information from a compromised host.(Citation: Malwarebytes Saint Bot April 2021)
	During C0026, the threat actors collected documents from compromised hosts.(Citation: Mandiant Suspected Turla Campaign February 2023)

Контрмера	Описание
Контрмеры
Data from Local System Mitigation	Identify unnecessary system utilities or potentially malicious software that may be used to collect data from the local system, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Data Loss Prevention	Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data.(Citation: PurpleSec Data Loss Prevention)

Обнаружение

Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, Network Device CLI commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. For network infrastructure devices, collect AAA logging to monitor `show` commands that view configuration files.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Данные из локальной системы

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги