Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Data Loss Prevention
is blocked by Detection of Local Data Collection Prior to Exfiltration
is blocked by Data Backups
is blocked by Continuous Monitoring
is blocked by Use of Cryptographic Controls
is blocked by Encrypting Data At Rest
is blocked by Cybersecurity & Data Protection Attributes
is blocked by Data Mining Protection
is blocked by Information Location
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Secure Engineering Principles
is blocked by Operations Security
Impressum Deutsch Englisch