T1005 Google Chronicle · YARA-L

Detect Data from Local System in Google Chronicle

Adversaries may search local system sources, such as file systems, configuration files, local databases, and process memory to find files of interest and sensitive data prior to Exfiltration. Adversaries commonly target credential stores (Windows DPAPI, browser databases, SSH keys), corporate documents (Office files, PDFs), and system databases (Active Directory NTDS.dit, SAM hive) using command interpreters, native OS utilities like esentutl.exe and robocopy.exe, or custom malware. Observed threat actors include Kimsuky (document theft), HAFNIUM (data collection post-exploitation), LAPSUS$ (credential and file theft for extortion), and malware families such as QakBot (esentutl for browser credential extraction) and BADNEWS (recursive crawl for Office/PDF files).

MITRE ATT&CK

Tactic
Collection
Technique
T1005 Data from Local System
Canonical reference
https://attack.mitre.org/techniques/T1005/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1005_data_local_system_process_collection {
  meta:
    author = "Detection Engineering"
    description = "Detects T1005 - Data from Local System: process-based collection via esentutl, shell/script interpreter sensitive path access, PowerShell recursive enumeration, and bulk copy tools"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1005"
    mitre_attack_technique_id = "T1005"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.1"
    platform = "Windows"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)esentutl\.exe$`)
        and re.regex($e.target.process.command_line,
          `(?i)(ntds|\.dit|login[ _]?data|cookies|web[ _]?data|/y\s|/vss)`)
      )
      or (
        re.regex($e.target.process.file.full_path,
          `(?i)(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe$`)
        and re.regex($e.target.process.command_line,
          `(?i)(\.ssh[/\\]|id_rsa|id_ed25519|id_ecdsa|microsoft.credentials|microsoft.protect|login[ _]?data|ntds\.dit|\.kdbx|filezilla|recentservers|winscp\.ini|\.pst|\.ost)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`)
        and re.regex($e.target.process.command_line,
          `(?i)(get-childitem.*-recurse|gci.*-recurse|gci.*-r\s|dir\s/s|tree\s/f|compress-archive)`)
        and re.regex($e.target.process.command_line,
          `(?i)(\.pdf|\.docx|\.xlsx|\.pptx|\.doc|\.xls|\.csv|\.pfx|\.p12|\.pem|\.key|\.kdbx|\.pst|\.ost|\.wallet)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(robocopy|xcopy)\.exe$`)
        and re.regex($e.target.process.command_line,
          `(?i)(\.ssh|credential|protect|\\\\sam|ntds|\.kdbx|filezilla|appdata)`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(where|findstr|find)\.exe$`)
        and re.regex($e.target.process.command_line,
          `(?i)(\.pdf|\.docx|\.xlsx|\.pfx|\.pem|\.key|\.kdbx|\.pst|\.ost|\.rdp|\.wallet)`)
      )
    )
    not re.regex($e.principal.process.file.full_path,
      `(?i)(MsMpEng|svchost|services|BackupAgent|OneDriveSetup)\.exe$`)

  condition:
    $e
}

rule t1005_data_local_system_file_access {
  meta:
    author = "Detection Engineering"
    description = "Detects T1005 - Data from Local System: direct file access to high-value credential stores, SSH keys, browser DBs, registry hives, NTDS.dit, KeePass vaults, and FTP credentials"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1005"
    mitre_attack_technique_id = "T1005"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.1"
    platform = "Windows"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    $e.principal.hostname = $hostname
    (
      re.regex($e.target.file.full_path,
        `(?i)(\\AppData\\(Local|Roaming)\\Microsoft\\(Credentials|Protect)\\)`)
      or (
        re.regex($e.target.file.full_path, `(?i)\.ssh[/\\]`)
        and re.regex($e.target.file.full_path, `(?i)(id_rsa|id_ed25519|id_ecdsa)$`)
      )
      or (
        re.regex($e.target.file.full_path, `(?i)(Google\\Chrome|Microsoft\\Edge)`)
        and re.regex($e.target.file.full_path, `(?i)Login Data$`)
      )
      or (
        re.regex($e.target.file.full_path, `(?i)Mozilla\\Firefox\\Profiles`)
        and re.regex($e.target.file.full_path, `(?i)(logins\.json|key4\.db|cert9\.db)$`)
      )
      or (
        re.regex($e.target.file.full_path, `(?i)\\Windows\\System32\\config\\`)
        and re.regex($e.target.file.full_path, `(?i)(SAM|SYSTEM|SECURITY|DEFAULT)$`)
      )
      or re.regex($e.target.file.full_path, `(?i)NTDS\\ntds\.dit$`)
      or re.regex($e.target.file.full_path, `(?i)\.kdbx$`)
      or (
        re.regex($e.target.file.full_path, `(?i)FileZilla`)
        and re.regex($e.target.file.full_path, `(?i)(recentservers\.xml|sitemanager\.xml)$`)
      )
      or re.regex($e.target.file.full_path, `(?i)WinSCP\.ini$`)
    )
    not re.regex($e.principal.process.file.full_path,
      `(?i)(svchost|MsMpEng|SearchIndexer|OneDrive|msedge|chrome|firefox)\.exe$`)

  condition:
    $e
}
high severity high confidence

Two Chronicle YARA-L 2.0 rules targeting UDM-normalized events. Rule 1 (process collection) matches PROCESS_LAUNCH events for esentutl ESE database extraction, shell/script interpreter access to credential paths, PowerShell recursive document enumeration, robocopy/xcopy bulk-copy against sensitive directories, and search utility misuse. Rule 2 (file access) matches FILE_CREATION events for direct writes or reads to Windows DPAPI credential stores, SSH private keys, browser credential databases (Chrome/Edge/Firefox), Windows registry hive files, Active Directory NTDS.dit, KeePass .kdbx vaults, FileZilla saved credentials, and WinSCP configuration. Both rules exclude known-good system and browser processes from the principal process context.

Data Sources

Google Chronicle SIEM with UDM normalizationWindows endpoint telemetry ingested via Chronicle forwarder or third-party EDR UDM mappingsSysmon or Microsoft Defender for Endpoint data normalized to UDM PROCESS_LAUNCH and FILE_CREATION event types

Required Tables

UDM PROCESS_LAUNCH events with target.process.file.full_path and target.process.command_line populatedUDM FILE_CREATION events with target.file.full_path populatedprincipal.process.file.full_path available for parent process exclusion filtering

False Positives & Tuning

  • Enterprise backup solutions using VSS snapshots to access NTDS.dit and registry hives will trigger the file access rule; these typically run as SYSTEM from backup agent executables not covered by the exclusion list — add backup agent process names to the not() clause
  • Developers generating or rotating SSH keys via ssh-keygen on developer workstations produce FILE_CREATION events for id_rsa/id_ed25519 paths — can be scoped by asset group tags if Chronicle has asset context enrichment configured
  • Security team red team exercises and authorized penetration testing engagements using esentutl for credential database extraction will produce high-fidelity matches — maintain a pentest engagement exclusion list keyed on source IP or host asset tag

Other platforms for T1005

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Recursive Document Collection via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.

  2. Test 2 Browser Credential Database Extraction via esentutl

    Expected signal: Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.

  3. Test 3 SSH Private Key Collection

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.

  4. Test 4 Windows DPAPI Credential Store Enumeration

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.

Last updated: 2026-04-13 Research depth: deep
References (5)

Response Playbook

Triage

  1. Identify the initiating process and user account — is this a known backup agent, IT tool, or service account? Cross-reference against the CMDB and change management system for approved activity.
  2. Examine the full command line if process-based: what paths are being enumerated, what extensions targeted, and is output being redirected to a staging location (e.g., 'dir /s /b > C:\Users\Public\files.txt')?
  3. For esentutl.exe alerts: determine the target database. esentutl targeting 'Login Data' (browser credentials) or 'ntds.dit' (AD database) is high-severity; targeting benign .db files less so. Check for VSS snapshot interaction (/vss flag).
  4. Check for staging artifacts: look for zip archives, newly created directories in temp/public paths (C:\Users\Public, C:\Temp, C:\Windows\Temp), or files with names inconsistent with normal operations created near the alert time.
  5. Correlate with network events: did the same process or a subsequent process make outbound connections within 30 minutes? Run DeviceNetworkEvents for the same device and AccountName in the alert window.
  6. Review the parent process chain — was the collection tool spawned by a suspicious parent (Office application, script host, service account outside change window)? Parent context often reveals the initial access vector.
  7. Check for Volume Shadow Copy creation (vssadmin.exe or wmic shadowcopy) in the 30 minutes preceding the alert — adversaries often use VSS to access locked files like ntds.dit and SAM.

Containment

  1. If active exfiltration is suspected or confirmed: isolate the endpoint immediately using EDR network isolation or emergency VLAN placement. Preserve isolation until forensics is complete.
  2. If credential stores were accessed (DPAPI Credentials, browser Login Data, .ssh/id_rsa, KeePass .kdbx): assume all stored credentials on that system are compromised. Initiate credential reset for the affected user and any service accounts accessible from that host.
  3. If NTDS.dit or SAM/SYSTEM hive files were accessed or copied: escalate to Tier 3 immediately — treat as a domain-wide credential compromise. Initiate krbtgt double-reset and review for Golden Ticket activity.
  4. If SSH keys were accessed: rotate all SSH key pairs that were readable from the compromised user's .ssh directory. Audit authorized_keys files on target systems for unauthorized additions.
  5. Block outbound transfers from the isolated host by verifying the network isolation policy is active. Check DNS logs for any data exfiltration over DNS that occurred before isolation.
  6. If data was staged locally (archive files in public or temp paths): preserve those files as forensic evidence before any cleanup — they may reveal the full scope of what was collected.

Evidence Collection

  1. Process tree and command lines: collect full Sysmon Event ID 1 logs (or Security Event ID 4688 with command line auditing) for the 2-hour window around the alert, filtered to the alerting user and suspicious processes.
  2. File creation and access events: Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete/moved) for the alerting host, looking for staging archives or collected file aggregations.
  3. Network connection events: Sysmon Event ID 3 (NetworkConnect) from the alerting process or account, particularly any outbound to non-corporate IPs — correlate timestamps with file collection activity.
  4. VSS-related activity: check for vssadmin.exe or wmic commands creating or listing shadow copies (Sysmon EventID 1, Security Event ID 4688) in the hours preceding the alert.
  5. PowerShell Script Block Logs (Event ID 4104 from Microsoft-Windows-PowerShell/Operational): if PowerShell was used, these logs capture full deobfuscated script content and will show file enumeration logic.
  6. Prefetch files on the endpoint: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, etc. — record execution timestamps and referenced file paths from prefetch metadata.
  7. Filesystem timeline: acquire MFT (Master File Table) for targeted drives using tools like Velociraptor or FTK Imager to identify files accessed or created in bulk during the collection window.
  8. Registry and memory artifacts: if credential theft is suspected, run volatility or an EDR memory scan on the lsass.exe process to detect in-memory credential access that may accompany file-based collection.

Escalation Criteria

  • !Any access to ntds.dit (Active Directory database) or SAM/SYSTEM/SECURITY registry hive files — even an attempted read indicates possible domain-level credential exposure and requires immediate Tier 3 escalation.
  • !esentutl.exe observed accessing browser Login Data databases with subsequent outbound network connections from any process on the same host within the collection window.
  • !SSH private key files accessed by a process other than the user's SSH client — particularly if followed by new SSH authentication events on other systems.
  • !Bulk file collection (>50 files in a single enumeration command) combined with archive creation in a world-writable path (C:\Users\Public, C:\Temp) — strong indicator of pre-exfiltration staging.
  • !The collecting process was spawned by a parent associated with initial access tradecraft: Office applications, browser processes, script hosts launching esentutl or PowerShell collection commands.
  • !Multiple sensitive path types accessed within a single session (e.g., .ssh keys AND browser credentials AND DPAPI stores) — breadth of collection indicates systematic adversary behavior rather than accidental access.

Investigation Guide

Related Techniques

T1119 — Automated Collection (scripts or malware automating the enumeration seen in T1005)T1560 — Archive Collected Data (staging collected files into archives before exfiltration)T1041 — Exfiltration Over C2 Channel (data collected locally then sent over established C2)T1048 — Exfiltration Over Alternative Protocol (collected data sent via DNS, HTTP, HTTPS)T1003.001 — LSASS Memory (in-memory credential theft complementing file-based collection)T1003.003 — NTDS (AD database dump — ntds.dit access is a specific T1005 variant)T1552.001 — Credentials In Files (file search for credentials stored in config files)T1059.001 — PowerShell (common interpreter for recursive file enumeration)T1059.003 — Windows Command Shell (dir /s, findstr for bulk file discovery)T1006 — Direct Volume Access (bypassing filesystem locks to access files like ntds.dit via raw volume reads)

Forensic Artifacts

  • >Prefetch directory: C:\Windows\Prefetch\ESENTUTL.EXE-*.pf, ROBOCOPY.EXE-*.pf, WHERE.EXE-*.pf — records execution timestamps and referenced file paths
  • >Shell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history including file enumeration commands
  • >Sysmon Event ID 1 logs: full command lines for process creation events, preserving exact enumeration syntax used by the adversary
  • >Sysmon Event ID 11 logs: file creation events revealing staging directories and archive filenames created during collection
  • >Volume Shadow Copies: if adversary used VSS-based access, shadow copy metadata persists even after the copy is deleted — check vssadmin list shadows
  • >MFT (Master File Table): MACB timestamps (Modified, Accessed, Changed, Born) for targeted files reveal whether access timestamps match claimed activity window
  • >Windows Event Log — Security Event ID 4663 (Object Access): if SACL auditing was configured on sensitive directories, provides a per-file record of access with process and account details
  • >Browser history and download records: adversary reconnaissance tools may be downloaded and launched from browser context — check %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (SQLite)
  • >Recycle Bin artifacts ($I files in C:\$Recycle.Bin): collection scripts or tools may have been deleted post-use, leaving recoverable metadata
  • >Windows Error Reporting: C:\ProgramData\Microsoft\Windows\WER\ReportQueue — esentutl failures or crashes may leave WER reports with command line context

Tuning Guidance

The primary source of false positives is backup software — Veeam, Acronis, Windows Server Backup, and similar tools legitimately access ntds.dit, registry hives, and credential paths via VSS. Build a suppression list of backup agent binary names and their associated service accounts, and exclude these combinations rather than the file paths alone. For PowerShell-based enumeration, tune by requiring both a recursive collection pattern AND a sensitive extension in the same command line — this substantially reduces false positives from developer scripts that enumerate directories but target benign file types. For esentutl.exe alerts, the presence of 'ntds', '.dit', or 'Login Data' in the command line is strongly anomalous outside of backup contexts; treat these as high confidence unless the initiating process is a documented backup agent. For file-access detections (DeviceFileEvents), note that browser processes (chrome.exe, msedge.exe, firefox.exe) legitimately access their own Login Data files — exclude these initiating processes but do NOT exclude the Login Data path itself, as access by any other process is suspicious. Consider enabling Windows SACL-based file auditing (Security Event ID 4663) on the C:\Windows\System32\config and NTDS directories for maximum fidelity credential access detection, accepting the volume overhead in exchange for per-file granularity.

Hunting Queries

Hunt for bulk or repeated usage of data collection utilities across the environment. High execution counts from a single user or spread across multiple devices may indicate scripted collection campaigns. Focuses on native tools commonly abused for T1005 that are less commonly seen in high volumes under normal operations.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "copy", "esentutl.exe", "where.exe", "findstr.exe")
| summarize
    ExecutionCount = count(),
    UniqueDevices = dcount(DeviceName),
    Commands = make_set(ProcessCommandLine, 20),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by AccountName, FileName
| where ExecutionCount > 5 or UniqueDevices > 2
| sort by ExecutionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\robocopy.exe" OR Image="*\\xcopy.exe" OR Image="*\\esentutl.exe" OR Image="*\\where.exe" OR Image="*\\findstr.exe")
| stats count as ExecutionCount, dc(host) as UniqueDevices, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User, Image
| where ExecutionCount > 5 OR UniqueDevices > 2
| sort - ExecutionCount

Hunt for archive files created in world-writable or temporary paths by unexpected processes — a strong indicator of pre-exfiltration staging. Adversaries collecting data from the local system frequently compress files before transmission. This query specifically targets staging locations used by threat actors and excludes known archive application binaries.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in~ ("FileCreated", "FileRenamed")
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar" or FileName endswith ".tar" or FileName endswith ".gz"
| where FolderPath has_any ("\\Users\\Public\\", "\\Windows\\Temp\\", "\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\")
| where InitiatingProcessFileName !in~ ("7zG.exe", "winrar.exe", "WinZip64.exe", "OneDrive.exe", "Backup")
| summarize
    ArchiveCount = count(),
    UniqueDevices = dcount(DeviceName),
    ArchiveNames = make_set(FileName, 10),
    Paths = make_set(FolderPath, 10)
    by InitiatingProcessFileName, InitiatingProcessAccountName
| where ArchiveCount > 2
| sort by ArchiveCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.zip" OR TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.tar" OR TargetFilename="*.gz")
  (TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Windows\\Temp\\*" OR TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\ProgramData\\*")
  NOT (Image="*\\7zG.exe" OR Image="*\\winrar.exe" OR Image="*\\WinZip64.exe" OR Image="*\\OneDrive.exe")
| stats count as ArchiveCount, dc(host) as UniqueDevices, values(TargetFilename) as ArchiveNames by Image, User
| where ArchiveCount > 2
| sort - ArchiveCount

Hunt for the VSS-then-esentutl attack chain used to extract locked files like ntds.dit, SAM, and SYSTEM hives. Adversaries must first create a Volume Shadow Copy to access files locked by the OS, then use esentutl or robocopy to read from the shadow volume. Both actions occurring on the same host within 60 minutes is a high-fidelity indicator of credential database theft.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("vssadmin", "wmic", "shadowcopy")
    and ProcessCommandLine has_any ("create", "list")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName =~ "esentutl.exe" and ProcessCommandLine has_any ("ntds", ".dit", "SAM", "SYSTEM", "SECURITY")
    | project DeviceName, EsentutlTime=Timestamp, EsentutlCmd=ProcessCommandLine
) on DeviceName
| where isnotempty(EsentutlTime) and abs(datetime_diff('minute', Timestamp, EsentutlTime)) < 60
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval is_vss=if(match(lower(CommandLine), "(vssadmin|shadowcopy|wmic.*shadow)") AND match(lower(CommandLine), "(create|list)"), 1, 0)
| eval is_esentutl=if(match(lower(Image), "esentutl\.exe") AND match(lower(CommandLine), "(ntds|\.dit|sam|system|security)"), 1, 0)
| where is_vss=1 OR is_esentutl=1
| eval sig=if(is_vss=1, "VSS_Create", "ESE_Extract")
| stats values(CommandLine) as Commands, values(sig) as Signals, dc(sig) as SigTypes, earliest(_time) as First, latest(_time) as Last by host, User
| where SigTypes > 1
| eval TimeWindowMinutes=round((Last-First)/60, 0)
| where TimeWindowMinutes < 60
| sort - SigTypes

Atomic Red Team Tests

Test 1 Recursive Document Collection via PowerShell
windows

Simulates adversary use of PowerShell to recursively enumerate and collect Office documents and PDFs from a user's home directory, mirroring behavior observed in Kimsuky and BADNEWS campaigns. The collected file list is written to a staging location in the temp directory. This test does not exfiltrate data — it only creates the enumeration artifact.

Command

powershell 
powershell.exe -NoProfile -Command "Get-ChildItem -Path $env:USERPROFILE -Recurse -Include '*.pdf','*.docx','*.xlsx','*.pptx','*.doc','*.xls' -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime | Export-Csv -Path $env:TEMP\df00tech-filelist.csv -NoTypeInformation"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-filelist.csv -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', and file extension patterns. Sysmon Event ID 11: FileCreate for df00tech-filelist.csv in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 showing the full collection script. File access events (if SACL auditing enabled, Security Event ID 4663) for each document accessed during enumeration.

Expected Detection

KQL: matches is_bulk_enum signal — PowerShell with Get-ChildItem -Recurse targeting sensitive extensions. SPL: is_bulk_enum=1, SuspicionScore >= 1. The CSV output file creation in TEMP may also trigger staging detection if further hunting queries are active.

Test 2 Browser Credential Database Extraction via esentutl
windows

Simulates the QakBot and LAPSUS$ technique of using esentutl.exe to copy the locked Chromium-based browser credential database (Login Data) to a readable location. Chrome's Login Data is an SQLite file locked by the browser process; esentutl /y performs a low-level copy bypassing the file lock. This test copies to a temp path without decrypting the credentials.

Command

powershell 
cmd.exe /c esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "%TEMP%\df00tech-logindata.db" /o

Cleanup

powershell 
del %TEMP%\df00tech-logindata.db 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for esentutl.exe with CommandLine containing '/y', 'Login Data', '/d', and '/o' flags. Sysmon Event ID 11: FileCreate for df00tech-logindata.db in %TEMP%. Security Event ID 4688 (if command line auditing enabled) capturing the full esentutl command. File access event on the Chrome Login Data file path.

Expected Detection

KQL and SPL: matches is_esentutl=1 on 'Login Data' keyword. SignalReason='ESE Database Extraction (browser creds or NTDS)'. High confidence trigger — esentutl accessing Login Data outside of backup contexts is anomalous. SuspicionScore >= 1 in SPL.

Test 3 SSH Private Key Collection
windows

Simulates adversary access to SSH private keys stored in the user's .ssh directory, as observed in Troll Stealer malware. Creates a test SSH key file and then copies it to a staging location to simulate collection. The test uses cmd.exe copy to avoid PowerShell detection, matching tradecraft that uses basic native commands for file access.

Command

powershell 
cmd.exe /c "mkdir %USERPROFILE%\.ssh 2>nul && echo -----BEGIN OPENSSH PRIVATE KEY----- > %USERPROFILE%\.ssh\id_rsa_test && echo [TEST CONTENT - NOT A REAL KEY] >> %USERPROFILE%\.ssh\id_rsa_test && echo -----END OPENSSH PRIVATE KEY----- >> %USERPROFILE%\.ssh\id_rsa_test && copy %USERPROFILE%\.ssh\id_rsa_test %TEMP%\df00tech-id_rsa.bak"

Cleanup

powershell 
del %USERPROFILE%\.ssh\id_rsa_test 2>nul & del %TEMP%\df00tech-id_rsa.bak 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing '.ssh' and 'copy' and 'id_rsa'. Sysmon Event ID 11: FileCreate for both the test key file in .ssh and the copied file in %TEMP%. DeviceFileEvents (MDE): FileCreated action on .ssh directory path with id_rsa in filename, initiating process cmd.exe. Security Event ID 4663 on the .ssh directory if SACL auditing is enabled.

Expected Detection

KQL ProcessCollection branch: cmd.exe with '.ssh' in CommandLine triggers is_sensitive_path_cli. KQL FileAccessCollection branch: FolderPath has '.ssh' and FileName contains 'id_rsa' triggers SignalReason='SSH Private Key Access'. SPL: is_sensitive_path_cli=1, SuspicionScore >= 1. File event detections fire on EventCode=11 matching .ssh path pattern.

Test 4 Windows DPAPI Credential Store Enumeration
windows

Simulates adversary enumeration of Windows DPAPI credential stores in %APPDATA%\Microsoft\Credentials, a technique used by credential-harvesting malware to locate encrypted credential blobs for offline decryption or DPAPI decryption using the user's master key. This test only lists the files without decrypting them.

Command

powershell 
cmd.exe /c dir /s /b "%APPDATA%\Microsoft\Credentials" && dir /s /b "%LOCALAPPDATA%\Microsoft\Credentials"

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'dir /s /b' and 'Microsoft\Credentials'. Security Event ID 4688 (if command line auditing enabled). If SACL auditing is configured on the Credentials directory, Security Event ID 4663 for directory access. DeviceProcessEvents (MDE) will capture the command with full path context.

Expected Detection

KQL ProcessCollection: cmd.exe with '\Microsoft\Credentials\' in ProcessCommandLine matches SensitivePathKeywords, SignalReason='Windows DPAPI Credential Store Access'. SPL: is_sensitive_path_cli=1 on 'credentials\\' pattern match, SuspicionScore >= 1. This test demonstrates that even basic dir commands against DPAPI paths generate actionable telemetry.

Related Detections

Tactic Hub

TA0009 Collection

Related Techniques

T1119 Automated Collection T1560 Archive Collected Data T1041 Exfiltration Over C2 Channel T1048 Exfiltration Over Alternative Protocol T1003.001 LSASS Memory T1003.003 NTDS T1552.001 Credentials In Files T1059.001 PowerShell T1059.003 Windows Command Shell T1006 Direct Volume Access

Same Tactic: Collection

Popular Detections