Data from Local System

What is Data from Local System?

Adversaries may search local system sources, such as file systems, configuration files, and local databases, to find files of interest and sensitive data prior to exfiltration. Adversaries may do this using a command shell (e.g., cmd) or scripting language (e.g., PowerShell) to search through the local file system, registry, and other data stores. Targeting of local data is common in both financially motivated attacks and espionage campaigns. Attackers typically search for documents containing sensitive business information, source code, customer data, intellectual property, financial records, and credentials. After identifying target files, attackers typically compress and encrypt the data before exfiltration to reduce transfer size and evade data loss prevention tools that inspect file contents. Understanding data collection behaviors is essential for building effective data-centric security monitoring.

“Data from Local System is documented as technique T1005 in the MITRE ATT&CK knowledge base under the Collection tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Data from Local System activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for mass file access events on endpoints, particularly processes reading large numbers of document files (Office documents, PDFs, text files) from user directories in short time periods suggesting automated collection.

2. 2

   Alert on compression utility usage followed by large file creation in staging directories, as attackers typically archive collected data before exfiltration to reduce transfer size and potentially encrypt contents.

3. 3

   Track access to sensitive data repositories including source code directories, financial document stores, and customer database exports, alerting on access by accounts or processes with no legitimate business need.

4. 4

   Detect staging behavior by monitoring for large amounts of data being consolidated into single directories or archives before being moved toward network egress points or removable media.

5. 5

   Monitor clipboard access by unusual processes on systems containing sensitive information, as attackers may use keyloggers and clipboard monitors to capture credentials and sensitive data as users interact with applications.

Example Alerts

These realistic alert examples show what Data from Local System looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Data from Local System?

SOC analysts detect Data from Local System (T1005) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for mass file access events on endpoints, particularly processes reading large numbers of document files (office documents, pdfs, text files) . SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Data from Local System?

Data from Local System can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the collection phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Data from Local System in real-world attacks?

Data from Local System is a well-documented MITRE ATT&CK technique in the Collection tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Data from Local System scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Data from Local System for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Collection techniques like Data from Local System. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.