Technique:  Data from Local System
Action RAT can collect local data from an infected machine.
Amadey can collect information from a compromised host.
It has collected large numbers of files from compromised network systems for later extraction.
AppleSeed can collect data on a compromised host.
It has collected files from a local victim.
It has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.
It has stolen data from compromised hosts.
It will identify Microsoft Office documents on the victim's computer.
It has collected data from victims' local systems.
It has collected data from a compromised host.
It has used various tools to steal files from the compromised host.
It has uploaded files and data from a compromised host.
AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.
It has collected data from a compromised network.
BADFLICK has uploaded files from victims' machines.
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.
BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.
Bandook can collect local files from the system .
Bankshot collects files from the local system.
Bazar can retrieve information from the infected machine.
Bisonal has collected information from a compromised host.
BlackMould can copy files on a compromised host.
BLINDINGCAN has uploaded files from victim machines.
BoxCaon can upload files from a compromised host.
It has exfiltrated files stolen from local systems.
Brute Ratel C4 has the ability to upload files from a compromised system.
Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.
During C0015, the threat actors obtained files and data from the compromised network.
During C0017, It collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.
During C0026, the threat actors collected documents from compromised hosts.
Calisto can collect data from user directories.
Caterpillar WebShell has a module to collect information from the local database.
ccf32 can collect files from a compromised host.
CharmPower can collect data and files from a compromised host.
China Chopper's server component can upload local files.
Chrommme can collect data from a local system.
Clambling can collect information from a compromised host.
Cobalt Strike can collect data from a local system.
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.
During CostaRicto, the threat actors collected data and files from compromised networks.
CreepyDrive can upload files to C2 from victim machines.
Crimson can collect information from a compromised host.
Crutch can exfiltrate files from compromised systems.
Cryptoistic can retrieve files from the local file system.
It has exfiltrated data from a compromised machine.
Cyclops Blink can upload files from a compromised host.
DanBot can upload files from compromised hosts.
It collected complete contents of the 'Pictures' folder from compromised Windows systems.
DarkWatchman can collect files from a compromised host.
DnsSystem can upload files from infected machines after receiving a command with uploaddd in the string.
It has collected data from local victim systems.
DRATzarus can collect information from a compromised host.
Drovorub can transfer files from the victim machine.
Dtrack can collect a variety of information from victim machines.
EnvyScout can collect sensitive NTLM material from a compromised host.
esentutl can be used to collect data from local file systems.
FatDuke can copy files and directories from a compromised host.
It has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.
It has collected and exfiltrated payment card data from compromised systems.
It has collected files and other sensitive information from a compromised network.
Flagpro can collect data from a compromised host, including Windows authentication information.
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.
FlawedAmmyy has collected information and files from a compromised machine.
FoggyWeb can retrieve configuration data from a compromised AD FS server.
Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).
It has searched local system resources to access sensitive documents.
FrameworkPOS can collect elements related to credit card data from process memory.
During Frankenstein, the threat actors used Empire to gather various local system information.
FunnyDream can upload files from victims' machines.
It collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
It has collected files from infected systems and uploaded them to a C2 server.
Gelsemium can collect data from a compromised host.
Goopy has the ability to exfiltrate documents from infected systems.
GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
Green Lambert can collect data from a compromised host.
GrimAgent can collect data and files from a compromised host.
It has collected data and files from a compromised machine.
Hikit can upload files from compromised machines.
Hydraq creates a backdoor through which remote attackers can read data from files.
IceApple can collect files, passwords, and other data from a compromised host.
It used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.
InvisiMole can collect data from the system, and can monitor changes in specified directories.
Ixeshe can collect data from a local system.
Kazuar uploads files from a specified directory to the C2 server.
It gathered information and files from local directories for exfiltration.
Kevin can upload logs and other data from a compromised host.
KGH_SPY can send a file containing victim system information to C2.
It has collected Office, PDF, and HWP documents from its victims.
Koadic can download files off the target system to send back to the server.
KONNI has stored collected information and discovered processes in a tmp file.
KOPILUWAK can gather information from compromised hosts.
It uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.
It has collected data and files from compromised networks.
LightNeuron can collect files from a local system.
Linfo creates a backdoor through which remote attackers can obtain data from local systems.
It has collected files and data from compromised machines.
It searches the File system for files of interest.
MacMa can collect then exfiltrate files from the compromised system.
Mafalda can collect files and information from a compromised host.
It has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.
MarkiRAT can upload data from the victim's machine to the C2 server.
MCMD has the ability to upload files from an infected device.
It has collected various files from the compromised computers.
metaMain can collect files and system information from a compromised host.
Milan can upload files from a compromised host.
Mis-Type has collected files and data from a compromised host.
Misdat has collected files and data from a compromised host.
MobileOrder exfiltrates data collected from the victim mobile device.
Mongall has the ability to upload files from victim's machines.
Nebulae has the capability to upload collected files to C2.
Neoichor can upload files from a victim's machine.
During Night Dragon, the threat actors collected files and other data from compromised systems.
NightClub can use a file monitor to steal specific files from targeted systems.
njRAT can collect data from a local system.
Octopus can exfiltrate files from the system using a documents collector tool.
During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.
During Operation Dream Job, It used malicious Trojans and DLL files to exfiltrate data from an infected host.
During Operation Honeybee, the threat actors collected data from compromised hosts.
During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.
Out1 can copy files and Registry data from compromised hosts.
OutSteel can collect information from a compromised host.
P.A.S. Webshell has the ability to copy files on a compromised host.
Pasam creates a backdoor through which remote attackers can retrieve files.
It collected and exfiltrated files from the infected system.
PcShare can collect files and information from a compromised host.
Pillowmint has collected credit card data using native API functions.
PinchDuke collects user files from the compromised host based on predefined file extensions.
PingPull can collect data from a compromised host.
PoisonIvy creates a backdoor through which remote attackers can steal system information.
PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.
PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.
POWERSTATS can upload files from compromised hosts.
Proxysvc searches the local system and gathers data.
PUNCHTRACK scrapes memory for properly formatted payment card data.
QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.
QuasarRAT can retrieve files from compromised client machines.
QuietSieve can collect files from a compromised host.
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.
Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.
RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.
RCSession can collect data from a compromised host.
Rising Sun has collected data and files from a compromised host.
ROKRAT can collect host data and specific file types.
Rover searches for files on local drives based on a predefined list of file extensions.
Saint Bot can collect files and information from a compromised host.
It has exfiltrated internal documents, files, and other data from compromised hosts.
Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.
SDBbot has the ability to access the file system on a compromised host.
Shark can upload files to its C2.
SharpDisco has dropped a recent-files stealer plugin to C:\Users\Public\WinSrcNT\It11.exe.
ShimRat has the capability to upload collected files to a C2.
SideTwist has the ability to upload files from a compromised host.
SLOTHFULMEDIA has uploaded files and information from victim machines.
During the SolarWinds Compromise, It extracted files from compromised networks.
SombRAT has collected data and files from a compromised host.
SpicyOmelette has collected data and other information from a compromised host.
STARWHALE can collect data from an infected local host.
It malware gathers data from the local victim system.
StrifeWater can collect data from a compromised host.
SUNBURST collected information from a compromised host.
SVCReady can collect data from an infected host.
SysUpdate can collect information and files from a compromised host.
Taidoor can upload data and files from a victim's machine.
TajMahal has the ability to steal documents from the local system including the print spooler queue.
It ran a command to compile an archive of file types of interest from the victim user's directories.
ThreatNeedle can collect data and files from a compromised host.
TinyIt can upload files from a compromised host.
Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.
TrickBot collects local files and information from the victim’s local machine.
It RPC backdoors can upload files from victim machines.
Uroburos can use its Get command to exfiltrate specified files from the compromised system.
Ursnif has collected files from victim machines, including certificates and cookies.
USBferry can collect information from an air-gapped host machine.
It has stolen the Active Directory database from targeted environments and used Wevtutil to extract event log information.
WarzoneRAT can collect data from a compromised host.
WellMail can exfiltrate files from the victim machine.
WellMess can send files from the victim machine to C2.
Wevtutil can be used to export events from a specific log.
It has used a script to gather credentials in files left on disk by OpenSSH backdoors.
It has collected data from a compromised host prior to exfiltration.
Woody RAT can collect information from a compromised host.
xCaon has uploaded files from victims' machines.
XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.
Zox has the ability to upload files from a targeted system.
ZxShell can transfer files from a compromised host.
ZxxZ can collect data from a compromised host.