Forensia CTI Core

About

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.

Platforms: ESXi, Linux, macOS, Network Devices, WindowsMITRE ATT&CK ↗

Software

169 malware/tools implement this

HikitTaidoorPoisonIvyIxesheChina ChopperUroburosFLASHFLOODPinchDukeCosmicDukeMobileOrderMisdatMis-TypeRoverCrimsonBADNEWSCobalt StrikeRawPOSForfilesPowerSploitPUNCHTRACKHydraqPasamLinfoPOWERSTATSBandookGravityRATProxysvcBankshotROKRATytyKoadicInvisiMoleQuasarRATKazuarTrickBotBisonalCalistoUPPERCUTBadPatchOctopusOSX_OCEANLOTUS.DKONNIFlawedAmmyynjRATUrsnifLightNeuronesentutlMacheteZxShellShimRatRising SunUSBferryRamsaySDBbotTajMahalGoopyCookieMinerCryptoisticMCMDDrovorubFrameworkPOSFatDukeWellMessWellMailPillowmintBLINDINGCANKGH_SPYSLOTHFULMEDIABazarCrutchSUNBURSTBlackMouldDtrackCaterpillar WebShellOut1P.A.S. WebshellSideTwistSombRATAppleSeedRainyDayNebulaeGrimAgentEnvyScoutBADFLICKWevtutilSpicyOmeletteQakBotBoxCaonMarkiRATxCaonXCSSETClamblingFoggyWebRCSessionSysUpdateThreatNeedleGelsemiumChrommmeTinyTurlaWarzoneRATTomirisZoxDarkWatchmanCharmPowerQuietSieveCyclops BlinkGreen LambertNeoichorDRATzarusFlagproPowerLessZxxZDanBotMilanMacMaOutSteelSaint BotSharkKevinDnsSystemIceAppleCreepyDriveAmadeyMongallAction RATAuTo StealerPingPullStrifeWaterSTARWHALEBumblebeeccf32FunnyDreamPcSharemetaMainMafaldaBrute Ratel C4SVCReadyWoody RATKOPILUWAKSardonicSharpDiscoNightClubSamuraiLoFiSePcexterSLIGHTPULSEDarkGateRAPIDPULSENPPSPYIPsec HelperMgBotRaccoon StealerCHIMNEYSWEEPDUSTTRAPLatrodectusTroll StealerStealBitCASTLETAPHavocRedLine StealerInvisibleFerretBeaverTailTruffleHogGlassWormBRICKSTORMLODEINFOHiddenFaceSPAWNCHIMERALAMEHUG

Corpus indicators tagged with this technique

5,738 indicators in the corpus carry T1005.

Indicator	Type	Family	Sev	Src
cve-2025-12057	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2026-0740	cve	—	85	1
cve-2025-7443	cve	—	85	1
cve-2025-2492	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2020-22658	cve	—	85	2
cve-2026-1969	cve	—	85	1
cve-2025-34085	cve	—	85	1
cve-2025-7852	cve	—	85	1
cve-2026-3844	cve	—	85	1
cve-2021-29441	cve	—	85	1
08060143ea9b55b480746b415af22e3a	hash	ransomware	80	1
3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5	sha256	phishing	80	1
b148626849c11dd5b3230632a38a6302	hash	ransomware	80	2
d6f479736ba55d3c4e895c4940d035cf772f3192fb8dc496f09a801aed16d970	sha256	phishing	80	1
24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54	hash	—	80	2
07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841	sha256	phishing	80	1
15d1002d9935fbfc9dfc65eb70fe4ecc0943c784	hash	ransomware	80	1
164e322d6fbc62e254d73583acd7f39444c884d3f5e6a5d27db143fc25bc88b3	sha256	supply_chain	80	1
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
17832aa629524ef6e8d8d6e9b6b902a8d324b559e3c36dbd0e221ab1690be871	sha256	supply_chain	80	1
c8075bbff748096e1c6a1ea0aa67bb6762fdd7551427a12425b35b94c1f1ecf2	sha256	supply_chain	80	1
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
25b6fc4f9c54a28ba7bfc4dfeafb62c99b59ea6f0d17679219b876b321965095	sha256	phishing	80	1
067ad6221b2224d5cdb64e51c5516132d820cf4d7edf9ec170643943e79c04b7	sha256	phishing	80	1
8111edf01ac6cb5c77e249d4e84fd92a85b5e89c2e2bef92fbe00b6f1cc2aa8e	sha256	phishing	80	1
833008c03d40422192051584d829d730497108bef31751cceb0cc043dd96bbfb	sha256	phishing	80	1
f0038a5f46720da5982b6984ceef10cf99359432e102b12a0b0657498d36f670	sha256	phishing	80	1
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1

Showing the top 30 by severity of 5,738.