Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1005

Data from Local System

Collection 170 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Potential Data Exfiltration Through Wget production 2026-10-09
snort ET TROJAN ContEXE Stealer Tasking Request - C2 Response rev 1 2026-10-06
snort ET TROJAN ContEXE Stealer Tasking Request rev 1 2026-10-06
snort ET TROJAN ContEXE Stealer Data Exfiltration - C2 Response rev 1 2026-10-06
suricata ET MALWARE ContEXE Stealer Data Exfiltration - C2 Response rev 1 2026-10-06
elastic Potential Privacy Control Bypass via Localhost Secure Copy production 2026-10-06
suricata ET MALWARE ContEXE Stealer Tasking Request rev 1 2026-10-06
suricata ET MALWARE ContEXE Stealer Tasking Request - C2 Response rev 1 2026-10-06
suricata ET MALWARE ContEXE Stealer Heartbeat Check - C2 Response rev 1 2026-10-05
snort ET TROJAN ContEXE Stealer CnC Checkin - C2 Response rev 1 2026-10-05
suricata ET MALWARE ContEXE Stealer CnC Checkin Attempt rev 1 2026-10-05
suricata ET MALWARE ContEXE Stealer Heartbeat Check rev 1 2026-10-05
snort ET TROJAN ContEXE Stealer Heartbeat Check rev 1 2026-10-05
snort ET TROJAN ContEXE Stealer CnC Checkin Attempt rev 1 2026-10-05
suricata ET MALWARE ContEXE Stealer CnC Checkin - C2 Response rev 1 2026-10-05
snort ET TROJAN ContEXE Stealer Heartbeat Check - C2 Response rev 1 2026-10-05
elastic LLM-Based Wget Activity Triage production 2026-09-25
elastic LLM-Based Curl Activity Triage via Auditd production 2026-09-25
elastic LLM-Based Curl Activity Triage production 2026-09-25
elastic LLM-Based Wget Activity Triage via Auditd production 2026-09-25
elastic GenAI Process Accessing Sensitive Files production 2026-09-25
elastic Web Server Local File Inclusion Activity production 2026-09-18
elastic AWS EC2 Export Task production 2026-09-18
elastic Sensitive File Compression Detected via Defend for Containers production 2026-09-18
elastic Sensitive Keys Or Passwords Search Detected via Defend for Containers production 2026-09-18
elastic Service Account Token or Certificate Read Detected via Defend for Containers production 2026-09-18
elastic Service Account Namespace Read Detected via Defend for Containers production 2026-09-18
elastic Credential Access via TruffleHog Execution production 2026-09-18
elastic Unusual Web Config File Access production 2026-09-18
elastic Encrypting Files with WinRar or 7z production 2026-09-18
elastic Exchange Mailbox Export via PowerShell production 2026-09-18
elastic Exporting Exchange Mailbox via PowerShell production 2026-09-18
elastic TCC Bypass via Mounted APFS Snapshot Access production 2026-09-18
elastic Suspicious TCC Access Granted for User Folders production 2026-09-18
elastic SystemKey Access via Command Line production 2026-09-18
elastic Suspicious Web Browser Sensitive File Access production 2026-09-18
elastic Sensitive File Access followed by Compression production 2026-09-18
elastic Potential Suspicious DebugFS Root Device Access production 2026-09-18
elastic Kernel Seeking Activity production 2026-09-18
elastic Manual Memory Dumping via Proc Filesystem production 2026-09-18
elastic Kubernetes Service Account Secret Access production 2026-09-18
elastic Linux init (PID 1) Secret Dump via GDB production 2026-09-18
elastic Potential Linux Credential Dumping via Unshadow production 2026-09-18
elastic Sensitive Files Compression Inside A Container production 2026-09-18
elastic Sensitive Files Compression production 2026-09-18
elastic AWS Credentials Searched For Inside A Container production 2026-09-18
suricata ET MALWARE RevStealer dl_exec Command from C2 rev 1 2026-06-17
suricata ET MALWARE RevStealer Data Exfiltration Attempt M1 rev 1 2026-06-17
suricata ET MALWARE RevStealer CnC Checkin rev 1 2026-06-17
suricata ET MALWARE RevStealer Sync Request rev 1 2026-06-17
snort ET TROJAN RevStealer Data Exfiltration Attempt M2 rev 1 2026-06-17
snort ET TROJAN RevStealer Sync Request rev 1 2026-06-17
snort ET TROJAN RevStealer dl_exec Command from C2 rev 1 2026-06-17
snort ET TROJAN RevStealer Data Exfiltration Attempt M1 rev 1 2026-06-17
snort ET TROJAN RevStealer CnC Checkin rev 1 2026-06-17
suricata ET MALWARE RevStealer Data Exfiltration Attempt M2 rev 1 2026-06-17
splunk PTC Windchill Gateway Command Execution production 2026-06-14
splunk Cisco ASA - Device File Copy to Remote Location production 2026-05-13
splunk ESXi VM Exported via Remote Tool production 2026-05-13
splunk Sqlite Module In Temp Folder production 2026-05-13
splunk Cisco TFTP Server Configuration for Data Exfiltration production 2026-05-13
splunk ESXi Sensitive Files Accessed production 2026-05-13
splunk Cisco ASA - Device File Copy Activity production 2026-05-13
snort ET TROJAN LedgerCheck User-Agent Observed rev 1 2026-05-06
suricata ET MALWARE LedgerCheck User-Agent Observed rev 1 2026-05-06
suricata ET MALWARE CripStealer Data Exfiltration Attempt rev 1 2026-04-13
snort ET TROJAN CripStealer Data Exfiltration Attempt rev 1 2026-04-13
snort ET TROJAN zgRAT / PureLogs CnC Ping Request rev 2 2026-02-26
suricata ET MALWARE zgRAT / PureLogs CnC Ping Request rev 2 2026-02-26
suricata ET MALWARE zgRAT / PureLogs CnC Browser Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Userinfo Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Browser Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Filesearch Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Finish Request rev 1 2026-02-25
suricata ET MALWARE zgRAT / PureLogs CnC Plugin Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Discord Request rev 1 2026-02-25
snort ET TROJAN zgRAT / PureLogs CnC Plugin Request rev 1 2026-02-25
suricata ET MALWARE zgRAT / PureLogs CnC Userinfo Request rev 1 2026-02-25
suricata ET MALWARE zgRAT / PureLogs CnC Finish Request rev 1 2026-02-25
suricata ET MALWARE zgRAT / PureLogs CnC Filesearch Request rev 1 2026-02-25
suricata ET MALWARE zgRAT / PureLogs CnC Discord Request rev 1 2026-02-25
suricata ET MALWARE Odyssey Stealer Data Exfiltration Attempt rev 1 2026-02-17
suricata ET MALWARE Odyssey Stealer CnC Checkin rev 1 2026-02-17
snort ET TROJAN Odyssey Stealer Data Exfiltration Attempt rev 1 2026-02-17
snort ET TROJAN Odyssey Stealer Repeat Request rev 1 2026-02-17
suricata ET MALWARE Odyssey Stealer Repeat Request rev 1 2026-02-17
snort ET TROJAN Odyssey Stealer Tasking Request rev 1 2026-02-17
snort ET TROJAN Odyssey Stealer CnC Checkin rev 1 2026-02-17
suricata ET MALWARE Odyssey Stealer Tasking Request rev 1 2026-02-17
snort ET TROJAN Marco Stealer Data Exfiltration Attempt rev 1 2026-02-06
suricata ET MALWARE Marco Stealer Data Exfiltration Attempt rev 1 2026-02-06
elastic Deprecated - AWS EC2 VM Export Failure deprecated 2026-01-16
snort ET TROJAN SantaStealer Data Exfiltration Attempt rev 1 2025-12-16
suricata ET MALWARE WallStealer Data Exfiltration Attempt over Telegram rev 1 2025-11-25
sigma Script Interpreter Spawning Credential Scanner - Windows experimental 2025-11-25
snort ET TROJAN WallStealer Data Exfiltration Attempt over Telegram rev 1 2025-11-25
sigma Script Interpreter Spawning Credential Scanner - Linux experimental 2025-11-25
suricata ET MALWARE OtterCookie File Exfiltration M2 rev 1 2025-11-20
snort ET TROJAN OtterCookie File Exfiltration M2 rev 1 2025-11-20
suricata ET MALWARE WallStealer CnC Checkin - Data Exfiltration rev 1 2025-11-19
suricata ET MALWARE WallStealer CnC Checkin - System Information rev 1 2025-11-19
suricata ET MALWARE WallStealer CnC Checkin - get_dll Request rev 1 2025-11-19
suricata ET MALWARE WallStealer CnC Response M1 rev 1 2025-11-19
suricata ET MALWARE WallStealer CnC Response M2 rev 1 2025-11-19
suricata ET MALWARE WallStealer CnC Response M3 rev 1 2025-11-19
suricata ET MALWARE Arkanix Stealer CnC Checkin rev 1 2025-11-19
suricata ET MALWARE Arkanix Stealer CnC Response M1 rev 1 2025-11-19
suricata ET MALWARE Arkanix Stealer Data Exfiltration Attempt rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Checkin - System Information rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Checkin - Data Exfiltration rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Checkin - get_dll Request rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Response M1 rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Response M2 rev 1 2025-11-19
snort ET TROJAN WallStealer CnC Response M3 rev 1 2025-11-19
snort ET TROJAN Arkanix Stealer CnC Checkin rev 1 2025-11-19
snort ET TROJAN Arkanix Stealer CnC Response M1 rev 1 2025-11-19
snort ET TROJAN Arkanix Stealer Data Exfiltration Attempt rev 1 2025-11-19
suricata ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M2 rev 1 2025-10-24
snort ET TROJAN Shark Stealer CnC Checkin rev 1 2025-10-24
snort ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M1 rev 1 2025-10-24
snort ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M2 rev 1 2025-10-24
suricata ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M1 rev 1 2025-10-24
suricata ET MALWARE Shark Stealer CnC Checkin rev 1 2025-10-24
suricata ET MALWARE Nimbus Manticore Minibrowse Backdoor CnC Checkin rev 1 2025-09-29
snort ET TROJAN Nimbus Manticore Minibrowse Backdoor CnC Checkin rev 1 2025-09-29
sigma Shai-Hulud NPM Package Malicious Exfiltration via Curl experimental 2025-09-24
suricata ET MALWARE Filch Stealer CnC Checkin rev 1 2025-09-19
snort ET TROJAN Filch Stealer CnC Checkin rev 1 2025-09-19
sigma Crash Dump Created By Operating System experimental 2025-05-12
snort ET RETIRED Win32/Fewin Stealer Data Exfiltration Attempt rev 3 2025-04-17
suricata ET RETIRED Win32/Fewin Stealer Data Exfiltration Attempt rev 4 2025-04-17
suricata ET MALWARE Generic Stealer Checkin rev 2 2024-04-27
suricata ET ADWARE_PUP Best-targeted-traffic.com Spyware Install rev 10 2024-04-13
suricata ET ADWARE_PUP Xpire.info Spyware Install Reporting rev 14 2024-04-13
suricata ET ADWARE_PUP Searchmiracle.com Spyware Installer silent.exe Download rev 14 2024-04-11
suricata ET MALWARE Jupyter Stealer CnC Checkin M2 rev 3 2024-04-03
suricata ET MALWARE Lumma Stealer Related Activity rev 2 2024-03-27
suricata ET ADWARE_PUP Socelars Related Domain in DNS Lookup rev 2 2024-03-25
suricata ET ADWARE_PUP Context Plus Spyware Install rev 11 2024-03-17
suricata ET ADWARE_PUP Overpro Spyware Install Report rev 11 2024-03-15
sigma OpenCanary - SMB File Open Request test 2024-03-08
suricata ET ADWARE_PUP Zenotecnico Spyware Install Report rev 9 2024-03-07
suricata ET ADWARE_PUP Deskwizz.com Spyware Install INI Download rev 8 2024-03-07
suricata ET ADWARE_PUP yupsearch.com Spyware Install - sideb.exe rev 11 2024-03-07
suricata ET ADWARE_PUP yupsearch.com Spyware Install - protector.exe rev 11 2024-03-07
sigma Esentutl Steals Browser Information test 2024-03-05
snort ET TROJAN Lumma Stealer Related Activity rev 2 2024-02-07
snort ET TROJAN RisePro TCP Heartbeat Packet rev 3 2024-01-10
suricata ET MALWARE RisePro TCP Heartbeat Packet rev 3 2024-01-10
snort ET TROJAN Generic Stealer Checkin rev 1 2023-12-27
sigma ADFS Database Named Pipe Connection By Uncommon Tool test 2023-11-30
sigma Veeam Backup Database Suspicious Query test 2023-05-04
sigma Potential Conti Ransomware Database Dumping Activity Via SQLCmd test 2023-05-04
sigma VeeamBackup Database Credentials Dump Via Sqlcmd.EXE test 2023-02-13
sigma SQLite Chromium Profile Data DB Access test 2023-01-19
sigma SQLite Firefox Profile Data DB Access test 2023-01-19
sigma Cisco Collect Data test 2023-01-04
sigma AWS EC2 VM Export Failure test 2022-10-05
snort ET MALWARE Socelars Related Domain in DNS Lookup rev 1 2021-07-28
snort ET MALWARE Deskwizz.com Spyware Install INI Download rev 5 2019-08-14
snort ET MALWARE Xpire.info Spyware Install Reporting rev 10 2019-08-14
snort ET MALWARE Searchmiracle.com Spyware Installer silent.exe Download rev 12 2019-08-14
snort ET MALWARE Context Plus Spyware Install rev 8 2019-08-14
snort ET MALWARE yupsearch.com Spyware Install - protector.exe rev 8 2019-08-14
snort ET MALWARE yupsearch.com Spyware Install - sideb.exe rev 8 2019-08-14
snort ET MALWARE Zenotecnico Spyware Install Report rev 7 2019-08-14
snort ET MALWARE Best-targeted-traffic.com Spyware Install rev 6 2019-08-14
sentinel ADFS DKM Master Key Export Scheduled —
sentinel Microsoft Entra ID Health Service Agents Registry Keys Access Scheduled —
sentinel Microsoft Entra ID Health Monitoring Agent Registry Keys Access Scheduled —