{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
  "created": "2019-10-10T15:12:42.790Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1533",
      "external_id": "T1533"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/stack-threats/STA-41.html",
      "external_id": "STA-41"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2026-05-12T15:12:00.722Z",
  "name": "Data from Local System",
  "description": "Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration.  \n\n \n\nAccess to local system data, which includes information stored by the operating system, often requires escalated privileges. Examples of local system data include authentication tokens, the device keyboard cache, Wi-Fi passwords, and photos. On Android, adversaries may also attempt to access files from external storage which may require additional storage-related permissions. \n\n ",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-mobile-attack",
      "phase_name": "collection"
    }
  ],
  "x_mitre_attack_spec_version": "3.3.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "mobile-attack"
  ],
  "x_mitre_is_subtechnique": false,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Android",
    "iOS"
  ],
  "x_mitre_version": "1.1",
  "x_mitre_tactic_type": [
    "Post-Adversary Device Access"
  ]
}