← Threat archive

T1005 Data from Local System

2 threats tracked by Spectrum Delta use this technique.

T1005 on MITRE ATT&CK →

  • OVHcloud CLI envchecker

    envchecker module: local secret staging and collection

    EDR process-attributed file telemetry: creation of temp dirs matching envchecker-[0-9]{9-10}, reads of ~/.aws/credentials, state.vscdb, ~/.claude, ~/.ssh and the other listed paths by the CLI process, archive creation in temp (Sysmon EID 11 captures creation/overwrite only — read-relevant telemetry required)

    Seen in: Sysmon / EDR

  • LiteLLM 1.107.0 backdoor

    Collector staging on the endpoint: openssl .pc_e_* packaging and inline LiteLLM proxy-DB queries

    auditd/Sysmon process-create for openssl with .pc_e_* paths and python -c with LiteLLM table patterns; file events for the .pc_once marker

    Seen in: Linux auditd, Microsoft Defender for Endpoint / Sysmon