Data from Local System
Description
Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
This can include basic fingerprinting information and sensitive data such as ssh keys.
- ATLAS ID
- AML.T0037
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique.
Case studies that use it
- AML.CS0015Compromised PyTorch Dependency Chain
- AML.CS0043Malware Prototype with Embedded Prompt Injection
- AML.CS0044LAMEHUG: Malware Leveraging Dynamic AI-Generated Commands
- AML.CS0061AI in the Middle: Web-Based AI Services as C2 Relays
- AML.CS0068Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure
- AML.CS0069GTG-1002 Claude Code Espionage Campaign
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared
- D3-RFAMRemote File Access Mediation1 shared
- D3-RFRestore File1 shared
- D3-CQContent Quarantine1 shared