type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--235b7491-2d2b-4617-9a52-3c0783680f71
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0055
external_id: DC0055
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: File Access
description: To events where a file is opened or accessed, making its contents available to the requester. This includes reading, executing, or interacting with files by authorized or unauthorized entities. Examples include logging file access events (e.g., Windows Event ID 4663), monitoring file reads, and detecting unusual file access patterns. Examples: 

- File Read Operations: A user opens a sensitive document (e.g., financial_report.xlsx) on a shared drive.
- File Execution: A script or executable file is accessed and executed (e.g., malware.exe is run from a temporary directory).
- Unauthorized File Access: An unauthorized user attempts to access a protected configuration file (e.g., `/etc/passwd` on Linux or `System32` files on Windows).
- File Access Patterns: Bulk access to multiple files in a short time (e.g., mass access to documents on a file server).
- File Access via Network: Files on a network share are accessed remotely (e.g., logs of SMB file access).
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: File
channel: None
name: m365:unified
channel: FileAccessed, MailboxAccessed
name: auditd:SYSCALL
channel: open, read, or stat of browser config files
name: macos:unifiedlog
channel: Access to ~/Library/*/Safari or Chrome directories by non-browser processes
name: WinEventLog:Security
channel: EventCode=4663, 4670, 4656
name: macos:unifiedlog
channel: file events
name: gcp:audit
channel: Write operations to storage
name: esxi:vmkernel
channel: VMFS access logs
name: macos:endpointsecurity
channel: ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations
name: auditd:SYSCALL
channel: open: File access attempt on /tmp/krb5cc_* or /tmp/krb5.ccache
name: macos:unifiedlog
channel: Kerberos framework calls to API:{uuid} cache outside normal process lineage
name: auditd:SYSCALL
channel: openat
name: auditd:FILE
channel: /home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data
name: macos:unifiedlog
channel: ~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json
name: auditd:SYSCALL
channel: open
name: auditd:FILE
channel: /proc/*/mem read attempt
name: auditd:PATH
channel: Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini)
name: macos:unifiedlog
channel: Read access to Time Machine plist files or CCC configurations in ~/Library/Preferences/
name: auditd:SYSCALL
channel: open, read
name: linux:syslog
channel: auth.log or custom tool logs
name: fs:fsusage
channel: file
name: linux:syslog
channel: /var/log/syslog
name: macos:osquery
channel: file_events
name: auditd:SYSCALL
channel: open, flock, fcntl, unlink
name: fs:fsusage
channel: File Access Monitor
name: macos:unifiedlog
channel: log stream - file subsystem
name: auditd:SYSCALL
channel: read/open of sensitive files
name: macos:unifiedlog
channel: file read of sensitive directories
name: esxi:hostd
channel: datastore file access
name: auditd:SYSCALL
channel: Unusual processes accessing or modifying cookie databases
name: macos:unifiedlog
channel: Abnormal process access to Safari or Chrome cookie storage
name: auditd:SYSCALL
channel: PATH records referencing /dev/video*
name: macos:endpointsecurity
channel: open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks
name: ebpf:syscalls
channel: container_file_activity
name: fs:fsusage
channel: Disk Activity Tracing
name: macos:keychain
channel: Access to Keychain DB or system.keychain
name: auditd:SYSCALL
channel: open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/
name: macos:keychain
channel: ~/Library/Keychains, /Library/Keychains
name: m365:unified
channel: Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365)
name: auditd:PATH
channel: open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)
name: macos:unifiedlog
channel: open: Access to /var/log/system.log or related security event logs
name: azure:activity
channel: CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows
name: esxi:hostd
channel: read: Access to sensitive log files by non-admin users
name: auditd:SYSCALL
channel: Processes reading credential or token cache files
name: auditd:SYSCALL
channel: read/open of sensitive file directories
name: esxi:hostd
channel: datastore/log file access
name: fs:fsusage
channel: filesystem activity
name: WinEventLog:Microsoft-Windows-Windows Defender/Operational
channel: Suspicious file execution on removable media path
name: auditd:PATH
channel: PATH
name: auditd:SYSCALL
channel: open/read of sensitive config or secret files
name: macos:unifiedlog
channel: open/read of *.plist or .env files
name: ebpf:syscalls
channel: open/read on secret mount paths
name: CloudTrail:GetObject
channel: sensitive credential files in buckets or local image storage
name: auditd:SYSCALL
channel: open/read of sensitive directories
name: macos:unifiedlog
channel: read of user document directories
name: esxi:syslog
channel: guest OS outbound transfer logs
name: fs:fsusage
channel: Filesystem Call Monitoring
name: esxi:hostd
channel: vSphere File API Access
name: auditd:SYSCALL
channel: open/read: Access to /proc/self/status with focus on TracerPID field
name: fs:fsusage
channel: read/write
name: esxis:vmkernel
channel: Datastore Access
name: auditd:SYSCALL
channel: open/read access to ~/.bash_history
name: macos:endpointsecurity
channel: open or read syscall to ~/.bash_history
name: macos:unifiedlog
channel: read access to ~/Library/Keychains/login.keychain-db
name: auditd:SYSCALL
channel: open,read
name: macos:unifiedlog
channel: filesystem and process events
name: auditd:SYSCALL
channel: open/read system calls to ~/.bash_history or /etc/shadow
name: macos:unifiedlog
channel: read access to ~/Library/Keychains or history files by terminal processes
name: auditd:SYSCALL
channel: read of /run/secrets or docker volumes by non-entrypoint process
name: macos:unifiedlog
channel: access to /Volumes/SharePoint or network mount
name: auditd:SYSCALL
channel: Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input
name: macos:unifiedlog
channel: Access to ~/Library/Safari/Bookmarks.plist or recent files
name: auditd:SYSCALL
channel: open/read
name: macos:unifiedlog
channel: access to keychain database
name: auditd:PATH
channel: file read
name: linux:syslog
channel: kernel messages related to cryptographic operations, module loading, and filesystem access patterns
name: fs:fsevents
channel: file system events indicating access to system configuration files and environmental information sources
name: macos:endpointsecurity
channel: es_event_open, es_event_exec
name: auditd:SYSCALL
channel: open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes
name: auditd:SYSCALL
channel: open or read to browser cookie storage
name: fs:fsusage
channel: file open for known browser cookie paths
name: auditd:SYSCALL
channel: open, read, mount
name: fs:fsusage
channel: file reads/writes from /Volumes/
name: macos:unifiedlog
channel: log stream - file provider subsystem
name: auditd:SYSCALL
channel: file
name: kubernetes:audit
channel: GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server
name: auditd:SYSCALL
channel: Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey
name: fs:quarantine
channel: /var/log/quarantine.log
name: desktop:file_manager
channel: nautilus, dolphin, or gvfs logs
name: linux:osquery
channel: /proc/*/maps access
name: auditd:SYSCALL
channel: open/read of sensitive directories (/etc, /home/*)
name: macos:unifiedlog
channel: read/write of user documents prior to upload
name: esxi:hostd
channel: file copy or datastore upload via HTTPS
name: macos:unifiedlog
channel: open/read access to private key files (id_rsa, *.pem, *.p12)
name: linux:osquery
channel: None
name: macos:osquery
channel: None
name: fs:fileevents
channel: File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)
name: auditd:FS
channel: read: File access to /proc/modules or /sys/module/
name: macos:unifiedlog
channel: read: File access to /System/Library/Extensions/ or related kernel extension paths
name: auditd:SYSCALL
channel: PATH
name: auditd:SYSCALL
channel: open/read on ~/.local/share/keepassxc/* OR ~/.password-store/*
name: macos:unifiedlog
channel: *.opvault OR *.ldb OR *.kdbx