CircleCI Atomic Red Team doc generator
35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# T1005 - Data from Local System
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1005)
|
|
<blockquote>Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.
|
|
|
|
Adversaries will often search the file system on computers they have compromised to find files of interest. They may do this using a [Command-Line Interface](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
|
|
</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Search macOS Safari Cookies](#atomic-test-1---search-macos-safari-cookies)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Search macOS Safari Cookies
|
|
This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.
|
|
|
|
**Supported Platforms:** macOS
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| search_string | String to search Safari cookies to find. | string | coinbase|
|
|
|
|
#### Run it with `sh`!
|
|
```
|
|
cd ~/Library/Cookies
|
|
grep -q "#{search_string}" "Cookies.binarycookies"
|
|
```
|
|
|
|
|
|
|
|
<br/>
|