Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Applied Cybernetics Group

T1005 Data from Local System

Technique
T1005
Tactics
Collection
Research, 90 days
12
KEV CVEs mapped
46
SigmaHQ rules
14
Elastic, Splunk
43
thrunt rules
0
Active families
ACRStealer, Formbook, Lumma, Stealc, Vidar
Upstream
https://attack.mitre.org/techniques/T1005

MITRE description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

Showing the 10 most recent of 12.

Detection coverage

SigmaHQ community rules

Elastic and Splunk rules

Showing 25 of 43.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.