Data from Local System

What is Data from Local System?

“Data from Local System is documented as technique T1005 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Data from Local System activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for mass file access events on endpoints, particularly processes reading large numbers of document files (Office documents, PDFs, text files) from user directories in short time periods suggesting automated collection.

2. 2

   Alert on compression utility usage followed by large file creation in staging directories, as attackers typically archive collected data before exfiltration to reduce transfer size and potentially encrypt contents.

3. 3

   Track access to sensitive data repositories including source code directories, financial document stores, and customer database exports, alerting on access by accounts or processes with no legitimate business need.

4. 4

   Detect staging behavior by monitoring for large amounts of data being consolidated into single directories or archives before being moved toward network egress points or removable media.

5. 5

   Monitor clipboard access by unusual processes on systems containing sensitive information, as attackers may use keyloggers and clipboard monitors to capture credentials and sensitive data as users interact with applications.

Example Alerts

These realistic alert examples show what Data from Local System looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Data from Local System?

Detection centers on XDR, SIEM telemetry for the collection phase of the attack. Monitor for mass file access events on endpoints, particularly processes reading large numbers of document files (Office documents, PDFs, text files) from user directories in short time periods suggesting automated collection. Alert on compression utility usage followed by large file creation in staging directories, as attackers typically archive collected data before exfiltration to reduce transfer size and potentially encrypt contents.

What does a Data from Local System alert look like?

A representative XDR detection is "Mass Document Collection Script Executed" (high severity): PowerShell script executed on executive workstation EX-WS-001 performing recursive search and copy of all .xlsx, .docx, .pdf, and .pptx files to a staging directory in C:\Users\Public. The script collected 2,847 documents totaling 4.3GB within 8 minutes. A 7zip compression process then created an encrypted archive of the staged files before network activity began toward an external destination.

Which tools detect Data from Local System, and how can I practice?

Data from Local System (T1005) is best surfaced with XDR, SIEM telemetry, which exposes the collection signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.