T1005

Data from Local System

Collection Last updated:

Adversaries may search local system sources, such as file systems, configuration files, local databases, and process memory to find files of interest and sensitive data prior to Exfiltration. Adversaries commonly target credential stores (Windows DPAPI, browser databases, SSH keys), corporate documents (Office files, PDFs), and system databases (Active Directory NTDS.dit, SAM hive) using command interpreters, native OS utilities like esentutl.exe and robocopy.exe, or custom malware. Observed threat actors include Kimsuky (document theft), HAFNIUM (data collection post-exploitation), LAPSUS$ (credential and file theft for extortion), and malware families such as QakBot (esentutl for browser credential extraction) and BADNEWS (recursive crawl for Office/PDF files).

What is T1005 Data from Local System?

Data from Local System (T1005) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Data from Local System, covering the data sources and telemetry it touches: Process: Process Creation, File: File Access, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1005 Data from Local System
Canonical reference
https://attack.mitre.org/techniques/T1005/
Microsoft Sentinel / Defender
kusto 
let SensitivePathKeywords = dynamic([
    "\\.ssh\\", "id_rsa", "id_ed25519", "id_ecdsa",
    "\\Microsoft\\Credentials\\", "\\Microsoft\\Protect\\",
    "Login Data", "Web Data", "Cookies",
    "ntds.dit", "\\config\\SAM", "\\config\\SYSTEM", "\\config\\SECURITY",
    "FileZilla", "recentservers.xml",
    "KeePass", ".kdbx",
    ".pst", ".ost"
]);
let BulkCollectionPatterns = dynamic([
    "dir /s", "dir /b /s", "tree /f",
    "Get-ChildItem -Recurse", "Get-ChildItem -Path", "gci -recurse", "gci -r ",
    "Get-Content", "Compress-Archive"
]);
let SensitiveExtensions = dynamic([
    ".pdf", ".docx", ".xlsx", ".pptx", ".doc", ".xls", ".csv",
    ".kdbx", ".pfx", ".p12", ".pem", ".key", ".cer", ".der",
    ".pst", ".ost", ".msg", ".wallet", ".rdp"
]);
// Branch 1: Process-based local data collection
let ProcessCollection = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // esentutl used for ESE database extraction (browser credential DBs, AD database)
    (FileName =~ "esentutl.exe"
     and ProcessCommandLine has_any ("ntds", "Login Data", "Cookies", "Web Data", "/y", ".dit", "/vss"))
    // Command shells or script hosts accessing known sensitive paths
    or (FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
        and ProcessCommandLine has_any (SensitivePathKeywords))
    // PowerShell recursive file search for sensitive document types
    or (FileName in~ ("powershell.exe", "pwsh.exe")
        and ProcessCommandLine has_any (BulkCollectionPatterns)
        and ProcessCommandLine has_any (SensitiveExtensions))
    // Robocopy or xcopy bulk-copying sensitive paths
    or (FileName in~ ("robocopy.exe", "xcopy.exe")
        and ProcessCommandLine has_any (SensitivePathKeywords))
    // where.exe or findstr used to locate specific file types at scale
    or (FileName in~ ("where.exe", "findstr.exe", "find.exe")
        and ProcessCommandLine has_any (SensitiveExtensions))
)
| where not(
    // Exclude well-known backup and security products by parent process
    InitiatingProcessFileName in~ ("MsMpEng.exe", "svchost.exe", "services.exe", "BackupAgent.exe", "OneDriveSetup.exe")
    and AccountName in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
)
| extend DetectionType = "Process-Based Collection"
| extend SignalReason = case(
    FileName =~ "esentutl.exe", "ESE Database Extraction (browser creds or NTDS)",
    ProcessCommandLine has_any ("ntds", "SAM", "SYSTEM", "SECURITY"), "AD/Registry Hive Targeted",
    ProcessCommandLine has_any (".ssh", "id_rsa", "id_ed25519"), "SSH Key Targeted",
    ProcessCommandLine has_any ("Login Data", "Cookies", "Web Data"), "Browser Credential DB Targeted",
    ProcessCommandLine has_any (BulkCollectionPatterns), "Bulk Recursive File Enumeration",
    FileName in~ ("robocopy.exe", "xcopy.exe"), "Bulk Copy Tool on Sensitive Path",
    "Sensitive Path Access via CLI"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType, SignalReason;
// Branch 2: Direct file access to high-value credential and data stores
let FileAccessCollection = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in~ ("FileRead", "FileCreated", "FileCopied", "FileRenamed")
| where (
    (FolderPath has "\\AppData\\Local\\Microsoft\\Credentials")
    or (FolderPath has "\\AppData\\Roaming\\Microsoft\\Credentials")
    or (FolderPath has "\\AppData\\Roaming\\Microsoft\\Protect")
    or (FolderPath has "\\.ssh" and FileName has_any ("id_rsa", "id_ed25519", "id_ecdsa", "config"))
    or (FolderPath has "Google\\Chrome" and FileName =~ "Login Data")
    or (FolderPath has "Microsoft\\Edge" and FileName =~ "Login Data")
    or (FolderPath has "Mozilla\\Firefox\\Profiles" and FileName has_any ("logins.json", "key4.db", "cert9.db"))
    or (FolderPath has "\\Windows\\System32\\config" and FileName in~ ("SAM", "SYSTEM", "SECURITY", "DEFAULT"))
    or (FolderPath has "NTDS" and FileName =~ "ntds.dit")
    or (FileName endswith ".kdbx")
    or (FolderPath has "FileZilla" and FileName in~ ("recentservers.xml", "sitemanager.xml"))
    or (FolderPath has "\\Roaming\\WinSCP" and FileName =~ "WinSCP.ini")
)
| where InitiatingProcessFileName !in~ (
    "svchost.exe", "System", "MsMpEng.exe", "SearchIndexer.exe",
    "OneDrive.exe", "msedge.exe", "chrome.exe", "firefox.exe"
)
| where InitiatingProcessAccountName !in~ ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| extend DetectionType = "File-Based Collection"
| extend SignalReason = case(
    FolderPath has "Credentials" or FolderPath has "Protect", "Windows DPAPI Credential Store Access",
    FolderPath has ".ssh", "SSH Private Key Access",
    FolderPath has "Login Data" or FolderPath has "logins.json", "Browser Credential DB Access",
    FolderPath has "\\config" and FileName in~ ("SAM", "SYSTEM", "SECURITY"), "Registry Hive File Access",
    FolderPath has "NTDS", "Active Directory Database Access",
    FileName endswith ".kdbx", "KeePass Password Database Access",
    FolderPath has "FileZilla" or FolderPath has "WinSCP", "FTP/SCP Saved Credential Access",
    "Sensitive File Access"
)
| project Timestamp, DeviceName,
         AccountName = InitiatingProcessAccountName,
         FileName, FolderPath, ActionType,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType, SignalReason;
union ProcessCollection, FileAccessCollection
| sort by Timestamp desc

Detects local data collection activity using two parallel approaches: (1) process-based detection targeting esentutl.exe database extraction, PowerShell recursive file enumeration for sensitive extensions, command shell access to credential paths (.ssh, DPAPI Credentials, browser Login Data, NTDS.dit), and bulk copy tool misuse; (2) file-event detection on direct access to high-value paths including Windows DPAPI credential stores, SSH private keys, browser credential databases, registry hive files (SAM/SYSTEM/SECURITY), and password manager databases. The union of both branches provides broad coverage across T1005 tradecraft. Results are annotated with SignalReason to aid analyst triage.

high severity medium confidence

Data Sources

Process: Process Creation File: File Access Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

  • Backup software (Veeam, Windows Backup, Acronis) accessing credential stores or NTDS.dit via VSS snapshots during scheduled jobs
  • Password managers (KeePass, Bitwarden) or browser sync services accessing their own databases during normal operation — exclude by initiating process name
  • IT administrators using robocopy or esentutl for legitimate data migration or database maintenance with documented change tickets
  • Antivirus or EDR products performing file scanning across sensitive directories — typically run as SYSTEM from known product binaries
  • Developers using Get-ChildItem -Recurse on document libraries for legitimate scripting or reporting tasks

Sigma rule & cross-platform mapping

The detection logic for Data from Local System (T1005) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1005 Sigma rules on detection.fyi

Platform-specific guides for T1005

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (5)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Recursive Document Collection via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.

  2. Test 2Browser Credential Database Extraction via esentutl

    Expected signal: Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.

  3. Test 3SSH Private Key Collection

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.

  4. Test 4Windows DPAPI Credential Store Enumeration

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.

Response Playbook

Triage

  1. Identify the initiating process and user account — is this a known backup agent, IT tool, or service account? Cross-reference against the CMDB and change management system for approved activity.
  2. Examine the full command line if process-based: what paths are being enumerated, what extensions targeted, and is output being redirected to a staging location (e.g., 'dir /s /b > C:\Users\Public\files.txt')?
  3. For esentutl.exe alerts: determine the target database. esentutl targeting 'Login Data' (browser credentials) or 'ntds.dit' (AD database) is high-severity; targeting benign .db files less so. Check for VSS snapshot interaction (/vss flag).
  4. Check for staging artifacts: look for zip archives, newly created directories in temp/public paths (C:\Users\Public, C:\Temp, C:\Windows\Temp), or files with names inconsistent with normal operations created near the alert time.
  5. Correlate with network events: did the same process or a subsequent process make outbound connections within 30 minutes? Run DeviceNetworkEvents for the same device and AccountName in the alert window.
  6. Review the parent process chain — was the collection tool spawned by a suspicious parent (Office application, script host, service account outside change window)? Parent context often reveals the initial access vector.
  7. Check for Volume Shadow Copy creation (vssadmin.exe or wmic shadowcopy) in the 30 minutes preceding the alert — adversaries often use VSS to access locked files like ntds.dit and SAM.

Containment

  1. If active exfiltration is suspected or confirmed: isolate the endpoint immediately using EDR network isolation or emergency VLAN placement. Preserve isolation until forensics is complete.
  2. If credential stores were accessed (DPAPI Credentials, browser Login Data, .ssh/id_rsa, KeePass .kdbx): assume all stored credentials on that system are compromised. Initiate credential reset for the affected user and any service accounts accessible from that host.
  3. If NTDS.dit or SAM/SYSTEM hive files were accessed or copied: escalate to Tier 3 immediately — treat as a domain-wide credential compromise. Initiate krbtgt double-reset and review for Golden Ticket activity.
  4. If SSH keys were accessed: rotate all SSH key pairs that were readable from the compromised user's .ssh directory. Audit authorized_keys files on target systems for unauthorized additions.
  5. Block outbound transfers from the isolated host by verifying the network isolation policy is active. Check DNS logs for any data exfiltration over DNS that occurred before isolation.
  6. If data was staged locally (archive files in public or temp paths): preserve those files as forensic evidence before any cleanup — they may reveal the full scope of what was collected.

Evidence Collection

  1. Process tree and command lines: collect full Sysmon Event ID 1 logs (or Security Event ID 4688 with command line auditing) for the 2-hour window around the alert, filtered to the alerting user and suspicious processes.
  2. File creation and access events: Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete/moved) for the alerting host, looking for staging archives or collected file aggregations.
  3. Network connection events: Sysmon Event ID 3 (NetworkConnect) from the alerting process or account, particularly any outbound to non-corporate IPs — correlate timestamps with file collection activity.
  4. VSS-related activity: check for vssadmin.exe or wmic commands creating or listing shadow copies (Sysmon EventID 1, Security Event ID 4688) in the hours preceding the alert.
  5. PowerShell Script Block Logs (Event ID 4104 from Microsoft-Windows-PowerShell/Operational): if PowerShell was used, these logs capture full deobfuscated script content and will show file enumeration logic.
  6. Prefetch files on the endpoint: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, etc. — record execution timestamps and referenced file paths from prefetch metadata.
  7. Filesystem timeline: acquire MFT (Master File Table) for targeted drives using tools like Velociraptor or FTK Imager to identify files accessed or created in bulk during the collection window.
  8. Registry and memory artifacts: if credential theft is suspected, run volatility or an EDR memory scan on the lsass.exe process to detect in-memory credential access that may accompany file-based collection.

Escalation Criteria

  • ! Any access to ntds.dit (Active Directory database) or SAM/SYSTEM/SECURITY registry hive files — even an attempted read indicates possible domain-level credential exposure and requires immediate Tier 3 escalation.
  • ! esentutl.exe observed accessing browser Login Data databases with subsequent outbound network connections from any process on the same host within the collection window.
  • ! SSH private key files accessed by a process other than the user's SSH client — particularly if followed by new SSH authentication events on other systems.
  • ! Bulk file collection (>50 files in a single enumeration command) combined with archive creation in a world-writable path (C:\Users\Public, C:\Temp) — strong indicator of pre-exfiltration staging.
  • ! The collecting process was spawned by a parent associated with initial access tradecraft: Office applications, browser processes, script hosts launching esentutl or PowerShell collection commands.
  • ! Multiple sensitive path types accessed within a single session (e.g., .ssh keys AND browser credentials AND DPAPI stores) — breadth of collection indicates systematic adversary behavior rather than accidental access.

Investigation Guide

Forensic Artifacts

  • > Prefetch directory: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, WHERE.EXE-*.pf — records execution timestamps and referenced file paths
  • > Shell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history including file enumeration commands
  • > Sysmon Event ID 1 logs: full command lines for process creation events, preserving exact enumeration syntax used by the adversary
  • > Sysmon Event ID 11 logs: file creation events revealing staging directories and archive filenames created during collection
  • > Volume Shadow Copies: if adversary used VSS-based access, shadow copy metadata persists even after the copy is deleted — check vssadmin list shadows
  • > MFT (Master File Table): MACB timestamps (Modified, Accessed, Changed, Born) for targeted files reveal whether access timestamps match claimed activity window
  • > Windows Event Log — Security Event ID 4663 (Object Access): if SACL auditing was configured on sensitive directories, provides a per-file record of access with process and account details
  • > Browser history and download records: adversary reconnaissance tools may be downloaded and launched from browser context — check %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite)
  • > Recycle Bin artifacts ($I files in C:\$Recycle.Bin): collection scripts or tools may have been deleted post-use, leaving recoverable metadata
  • > Windows Error Reporting: C:\ProgramData\Microsoft\Windows\WER\ReportQueue — esentutl failures or crashes may leave WER reports with command line context

Tuning Guidance

The primary source of false positives is backup software — Veeam, Acronis, Windows Server Backup, and similar tools legitimately access ntds.dit, registry hives, and credential paths via VSS. Build a suppression list of backup agent binary names and their associated service accounts, and exclude these combinations rather than the file paths alone. For PowerShell-based enumeration, tune by requiring both a recursive collection pattern AND a sensitive extension in the same command line — this substantially reduces false positives from developer scripts that enumerate directories but target benign file types. For esentutl.exe alerts, the presence of 'ntds', '.dit', or 'Login Data' in the command line is strongly anomalous outside of backup contexts; treat these as high confidence unless the initiating process is a documented backup agent. For file-access detections (DeviceFileEvents), note that browser processes (chrome.exe, msedge.exe, firefox.exe) legitimately access their own Login Data files — exclude these initiating processes but do NOT exclude the Login Data path itself, as access by any other process is suspicious. Consider enabling Windows SACL-based file auditing (Security Event ID 4663) on the C:\Windows\System32\config and NTDS directories for maximum fidelity credential access detection, accepting the volume overhead in exchange for per-file granularity.

Hunting Queries

Hunt for bulk or repeated usage of data collection utilities across the environment. High execution counts from a single user or spread across multiple devices may indicate scripted collection campaigns. Focuses on native tools commonly abused for T1005 that are less commonly seen in high volumes under normal operations.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "copy", "esentutl.exe", "where.exe", "findstr.exe")
| summarize
    ExecutionCount = count(),
    UniqueDevices = dcount(DeviceName),
    Commands = make_set(ProcessCommandLine, 20),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by AccountName, FileName
| where ExecutionCount > 5 or UniqueDevices > 2
| sort by ExecutionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\robocopy.exe" OR Image="*\\xcopy.exe" OR Image="*\\esentutl.exe" OR Image="*\\where.exe" OR Image="*\\findstr.exe")
| stats count as ExecutionCount, dc(host) as UniqueDevices, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User, Image
| where ExecutionCount > 5 OR UniqueDevices > 2
| sort - ExecutionCount

Hunt for archive files created in world-writable or temporary paths by unexpected processes — a strong indicator of pre-exfiltration staging. Adversaries collecting data from the local system frequently compress files before transmission. This query specifically targets staging locations used by threat actors and excludes known archive application binaries.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in~ ("FileCreated", "FileRenamed")
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar" or FileName endswith ".tar" or FileName endswith ".gz"
| where FolderPath has_any ("\\Users\\Public\\", "\\Windows\\Temp\\", "\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\")
| where InitiatingProcessFileName !in~ ("7zG.exe", "winrar.exe", "WinZip64.exe", "OneDrive.exe", "Backup")
| summarize
    ArchiveCount = count(),
    UniqueDevices = dcount(DeviceName),
    ArchiveNames = make_set(FileName, 10),
    Paths = make_set(FolderPath, 10)
    by InitiatingProcessFileName, InitiatingProcessAccountName
| where ArchiveCount > 2
| sort by ArchiveCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.zip" OR TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.tar" OR TargetFilename="*.gz")
  (TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Windows\\Temp\\*" OR TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\ProgramData\\*")
  NOT (Image="*\\7zG.exe" OR Image="*\\winrar.exe" OR Image="*\\WinZip64.exe" OR Image="*\\OneDrive.exe")
| stats count as ArchiveCount, dc(host) as UniqueDevices, values(TargetFilename) as ArchiveNames by Image, User
| where ArchiveCount > 2
| sort - ArchiveCount

Hunt for the VSS-then-esentutl attack chain used to extract locked files like ntds.dit, SAM, and SYSTEM hives. Adversaries must first create a Volume Shadow Copy to access files locked by the OS, then use esentutl or robocopy to read from the shadow volume. Both actions occurring on the same host within 60 minutes is a high-fidelity indicator of credential database theft.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("vssadmin", "wmic", "shadowcopy")
    and ProcessCommandLine has_any ("create", "list")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName =~ "esentutl.exe" and ProcessCommandLine has_any ("ntds", ".dit", "SAM", "SYSTEM", "SECURITY")
    | project DeviceName, EsentutlTime=Timestamp, EsentutlCmd=ProcessCommandLine
) on DeviceName
| where isnotempty(EsentutlTime) and abs(datetime_diff('minute', Timestamp, EsentutlTime)) < 60
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval is_vss=if(match(lower(CommandLine), "(vssadmin|shadowcopy|wmic.*shadow)") AND match(lower(CommandLine), "(create|list)"), 1, 0)
| eval is_esentutl=if(match(lower(Image), "esentutl\.exe") AND match(lower(CommandLine), "(ntds|\.dit|sam|system|security)"), 1, 0)
| where is_vss=1 OR is_esentutl=1
| eval sig=if(is_vss=1, "VSS_Create", "ESE_Extract")
| stats values(CommandLine) as Commands, values(sig) as Signals, dc(sig) as SigTypes, earliest(_time) as First, latest(_time) as Last by host, User
| where SigTypes > 1
| eval TimeWindowMinutes=round((Last-First)/60, 0)
| where TimeWindowMinutes < 60
| sort - SigTypes

Atomic Red Team Tests

Test 1 Recursive Document Collection via PowerShell
windows

Simulates adversary use of PowerShell to recursively enumerate and collect Office documents and PDFs from a user's home directory, mirroring behavior observed in Kimsuky and BADNEWS campaigns. The collected file list is written to a staging location in the temp directory. This test does not exfiltrate data — it only creates the enumeration artifact.

Command

powershell 
powershell.exe -NoProfile -Command "Get-ChildItem -Path $env:USERPROFILE -Recurse -Include '*.pdf','*.docx','*.xlsx','*.pptx','*.doc','*.xls' -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime | Export-Csv -Path $env:TEMP\df00tech-filelist.csv -NoTypeInformation"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-filelist.csv -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.

Expected Detection

KQL: matches is_bulk_enum signal — PowerShell with Get-ChildItem -Recurse targeting sensitive extensions. SPL: is_bulk_enum=1, SuspicionScore >= 1. The CSV output file creation in TEMP may also trigger staging detection if further hunting queries are active.

Test 2 Browser Credential Database Extraction via esentutl
windows

Simulates the QakBot and LAPSUS$ technique of using esentutl.exe to copy the locked Chromium-based browser credential database (Login Data) to a readable location. Chrome's Login Data is an SQLite file locked by the browser process; esentutl /y performs a low-level copy bypassing the file lock. This test copies to a temp path without decrypting the credentials.

Command

powershell 
cmd.exe /c esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "%TEMP%\df00tech-logindata.db" /o

Cleanup

powershell 
del %TEMP%\df00tech-logindata.db 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.

Expected Detection

KQL and SPL: matches is_esentutl=1 on 'Login Data' keyword. SignalReason='ESE Database Extraction (browser creds or NTDS)'. High confidence trigger — esentutl accessing Login Data outside of backup contexts is anomalous. SuspicionScore >= 1 in SPL.

Test 3 SSH Private Key Collection
windows

Simulates adversary access to SSH private keys stored in the user's .ssh directory, as observed in Troll Stealer malware. Creates a test SSH key file and then copies it to a staging location to simulate collection. The test uses cmd.exe copy to avoid PowerShell detection, matching tradecraft that uses basic native commands for file access.

Command

powershell 
cmd.exe /c "mkdir %USERPROFILE%\.ssh 2>nul && echo -----BEGIN OPENSSH PRIVATE KEY----- > %USERPROFILE%\.ssh\id_rsa_test && echo [TEST CONTENT - NOT A REAL KEY] >> %USERPROFILE%\.ssh\id_rsa_test && echo -----END OPENSSH PRIVATE KEY----- >> %USERPROFILE%\.ssh\id_rsa_test && copy %USERPROFILE%\.ssh\id_rsa_test %TEMP%\df00tech-id_rsa.bak"

Cleanup

powershell 
del %USERPROFILE%\.ssh\id_rsa_test 2>nul & del %TEMP%\df00tech-id_rsa.bak 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.

Expected Detection

KQL ProcessCollection branch: cmd.exe with '.ssh' in CommandLine triggers is_sensitive_path_cli. KQL FileAccessCollection branch: FolderPath has '.ssh' and FileName contains 'id_rsa' triggers SignalReason='SSH Private Key Access'. SPL: is_sensitive_path_cli=1, SuspicionScore >= 1. File event detections fire on EventCode=11 matching .ssh path pattern.

Test 4 Windows DPAPI Credential Store Enumeration
windows

Simulates adversary enumeration of Windows DPAPI credential stores in %APPDATA%\Microsoft\Credentials, a technique used by credential-harvesting malware to locate encrypted credential blobs for offline decryption or DPAPI decryption using the user's master key. This test only lists the files without decrypting them.

Command

powershell 
cmd.exe /c dir /s /b "%APPDATA%\Microsoft\Credentials" && dir /s /b "%LOCALAPPDATA%\Microsoft\Credentials"

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.

Expected Detection

KQL ProcessCollection: cmd.exe with '\Microsoft\Credentials\' in ProcessCommandLine matches SensitivePathKeywords, SignalReason='Windows DPAPI Credential Store Access'. SPL: is_sensitive_path_cli=1 on 'credentials\\' pattern match, SuspicionScore >= 1. This test demonstrates that even basic dir commands against DPAPI paths generate actionable telemetry.

Related Detections

Tactic Hub

TA0009Collection

Related Techniques

T1119Automated CollectionT1560Archive Collected DataT1041Exfiltration Over C2 ChannelT1048Exfiltration Over Alternative ProtocolT1003.001LSASS MemoryT1003.003NTDST1552.001Credentials In FilesT1059.001PowerShellT1059.003Windows Command ShellT1006Direct Volume Access

Same Tactic: Collection

Popular Detections