# T1005 - Data from Local System ## SOC Recommendation Investigate Data from Local System activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign. ## D3FEND Mappings | D3FEND Technique | Relationship | Practical SOC Action | |---|---|---| | File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. | | File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. | | File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. | | Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. | ## Investigation Steps 1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity. 2. Check Sentinel analytics rules and incidents correlated with this technique. 3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource. ## Evidence to Collect - Host or resource affected - Account or identity involved - Timestamp of the activity - Related process, file, or network artifact - Any preceding or follow-on alerts ## Response Actions | Action | Risk | Automation Safe | Approval Required | |---|---|---|---| | Contain the affected host or account | Medium | No | Yes | | Collect and preserve evidence | Low | Yes | No | ## KQL ```kql blacklens_CL | summarize arg_max(TimeGenerated, *) by id | extend AlertSeverity = case( tolower(severity) == "critical", "High", tolower(severity) == "high", "High", tolower(severity) == "medium", "Medium", tolower(severity) == "low", "Low", "Informational" ) ``` ```kql ContrastADRAttackEvents_CL | where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION" | project-rename hostname = host_hostname //please add your DLP logs table in place of ContrastWAFLogs_CL and hostname colomun in place of hostname below and uncomment the queries below //| join kind= inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on hostname ``` ```kql let iocs = externaldata(DateAdded:string,IoC:string,Type:string,TLP:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/FoggyWebIOC.csv"] with (format="csv", ignoreFirstRecord=True); let sha256Hashes = (iocs | where Type == "sha256" | project IoC); let FilePaths = (iocs | where Type =~ "FilePath" | project IoC); let POST_URI = (iocs | where Type =~ "URI1" | project IoC); let GET_URI = (iocs | where Type =~ "URI2" | project IoC); //Include in the list below, the ADFS servers you know about in your environment. In the next part of the query, we will try to identify them for you if you have the telemetry. let ADFS_Servers1 = datatable(Computer:string) [ "..", ".." ]; // Automatically identify potential ADFS services in your environment by searching process event telemetry for "Microsoft.IdentityServer.ServiceHost.exe". let ADFS_Servers2 = (union isfuzzy=true (SecurityEvent | where EventID == 4688 and SubjectLogonId != "0x3e4" | where ProcessName has "Microsoft.IdentityServer.ServiceHost.exe" | distinct Computer ), ( WindowsEvent | where EventID == 4688 and EventData has "Microsoft.IdentityServer.ServiceHost.exe"// and not(EventData has "0x3e4") | extend ProcessName = tostring(EventData.ProcessName) | where ProcessName == "Microsoft.IdentityServer.ServiceHost.exe" | extend SubjectLogonId = tostring(EventData.SubjectLogonId) | where SubjectLogonId != "0x3e4" | distinct Computer ), (DeviceProcessEvents | where InitiatingProcessFileName == 'Microsoft.IdentityServer.ServiceHost.exe' | extend Computer = DeviceName | distinct Computer ), (Event | where Source == "Microsoft-Windows-Sysmon" | where EventID == 1 | extend EventData = parse_xml(EventData).DataItem.EventData.Data | mv-expand bagexpansion=array EventData | evaluate bag_unpack(EventData) | extend Key=tostring(['@Name']), Value=['#text'] | evaluate pivot(Key, any(Value), TimeGenerated, Source, EventLog, Computer, EventLevel, EventLevelName, UserName, RenderedDescription, MG, ManagementGroupName, Type, _ResourceId) | extend process = split(Image, '\\', -1)[-1] | where process =~ "Microsoft.IdentityServer.ServiceHost.exe" | distinct Computer ) ); let ADFS_Servers = ADFS_Servers1 | union (ADFS_Servers2 | distinct Computer); (union isfuzzy=true (DeviceNetworkEvents | where DeviceName in (ADFS_Servers) | where isnotempty(InitiatingProcessSHA256) or isnotempty(InitiatingProcessFolderPath) | where InitiatingProcessSHA256 has_any (sha256Hashes) or InitiatingProcessFolderPath has_any (FilePaths) | project TimeGenerated, ActionType, DeviceId, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessParentFileName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, LocalIP, Type | extend timestamp = TimeGenerated, IPCustomEntity = RemoteIP, HostCustomEntity = DeviceName ), (Event | where Source == "Microsoft-Windows-Sysmon" and EventID == '7' | where Computer in (ADFS_Servers) | extend EvData = parse_xml(EventData) | extend EventDetail = EvData.DataItem.EventData.Data | extend ImageLoaded = EventDetail.[5].["#text"], Hashes = EventDetail.[11].["#text"] | parse Hashes with * 'SHA256=' SHA256 '",' * | where ImageLoaded has_any (FilePaths) or SHA256 has_any (sha256Hashes) | project TimeGenerated, EventDetail, UserName, Computer, Type, Source, SHA256, ImageLoaded, EventID | extend Type = strcat(Type,":",EventID, ": ", Source), Account = UserName, FileHash = SHA256, Image = EventDetail.[4].["#text"] | extend timestamp = TimeGenerated, HostCustomEntity = Computer , AccountCustomEntity = Account, ProcessCustomEntity = tostring(split(Image, '\\', -1)[-1]), AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (CommonSecurityLog | where FileHash in (sha256Hashes) | project TimeGenerated, Message, SourceUserID, FileHash, Type | extend timestamp = TimeGenerated, AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (DeviceEvents | where DeviceName in (ADFS_Servers) | extend FilePath = strcat(FolderPath, '\\', FileName) | where InitiatingProcessSHA256 has_any (sha256Hashes) or FilePath has_any (FilePaths) | project TimeGenerated, ActionType, DeviceId, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessSHA256, Type | extend Account = InitiatingProcessAccountName, Computer = DeviceName, CommandLine = InitiatingProcessCommandLine, FileHash = InitiatingProcessSHA256, Image = InitiatingProcessFolderPath | extend timestamp = TimeGenerated, HostCustomEntity = Computer , AccountCustomEntity = Account, ProcessCustomEntity = InitiatingProcessFileName, AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (DeviceFileEvents | where DeviceName in (ADFS_Servers) | where FolderPath has_any (FilePaths) or SHA256 has_any (sha256Hashes) | project TimeGenerated, ActionType, DeviceId, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessSHA256, Type | extend Account = InitiatingProcessAccountName, Computer = DeviceName, CommandLine = InitiatingProcessCommandLine, FileHash = InitiatingProcessSHA256, Image = InitiatingProcessFolderPath | extend timestamp = TimeGenerated, HostCustomEntity = Computer , AccountCustomEntity = Account, ProcessCustomEntity = InitiatingProcessFileName, AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (DeviceImageLoadEvents | where DeviceName in (ADFS_Servers) | where FolderPath has_any (FilePaths) or SHA256 has_any (sha256Hashes) | project TimeGenerated, ActionType, DeviceId, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessSHA256, Type | extend Account = InitiatingProcessAccountName, Computer = DeviceName, CommandLine = InitiatingProcessCommandLine, FileHash = InitiatingProcessSHA256, Image = InitiatingProcessFolderPath | extend timestamp = TimeGenerated, HostCustomEntity = Computer , AccountCustomEntity = Account, ProcessCustomEntity = InitiatingProcessFileName, AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (Event | where Source == "Microsoft-Windows-Sysmon" | where Computer in (ADFS_Servers) | extend EvData = parse_xml(EventData) | extend EventDetail = EvData.DataItem.EventData.Data | parse EventDetail with * 'SHA256=' SHA256 '",' * | where EventDetail has_any (sha256Hashes) | project TimeGenerated, EventDetail, UserName, Computer, Type, Source, SHA256 | extend Type = strcat(Type, ": ", Source), Account = UserName, FileHash = SHA256, Image = EventDetail.[4].["#text"] | extend timestamp = TimeGenerated, HostCustomEntity = Computer , AccountCustomEntity = Account, ProcessCustomEntity = tostring(split(Image, '\\', -1)[-1]), AlgorithmCustomEntity = "SHA256", FileHashCustomEntity = FileHash ), (W3CIISLog | where ( csMethod == 'GET' and csUriStem has_any (GET_URI)) or (csMethod == 'POST' and csUriStem has_any (POST_URI)) | summarize StartTime = max(TimeGenerated), EndTime = min(TimeGenerated), cIP_MethodCount = count() by cIP, cIP_MethodCountType = "Count of repeated entries, this is to reduce rowsets returned", csMethod, csHost, scStatus, sIP, csUriStem, csUriQuery, csUserName, csUserAgent, csCookie, csReferer | extend timestamp = StartTime, IPCustomEntity = cIP, HostCustomEntity = csHost, AccountCustomEntity = csUserName ), (imFileEvent | where DvcHostname in (ADFS_Servers) | where TargetFileSHA256 has_any (sha256Hashes) or FilePath has_any (FilePaths) | extend Account = ActorUsername, Computer = DvcHostname, IPAddress = SrcIpAddr, CommandLine = ActingProcessCommandLine, FileHash = TargetFileSHA256 | project Type, TimeGenerated, Computer, Account, IPAddress, CommandLine, FileHash ) ) ``` ## Escalation Criteria - Data from Local System activity observed on a privileged account or critical system. - Activity follows or precedes other suspicious behaviour in the same investigation. - Automated triage cannot confidently rule out malicious intent. ## False Positive Considerations - Legitimate administrative or maintenance activity matching this pattern. - Approved security testing or red team exercise. - Known benign software producing similar telemetry. Generated by SOC Response Atlas by Basyrix.