Collect Data from Common Resource Locations is the harvesting of files from standard directories where applications, users, or services commonly store data. Attackers target these locations to find credentials, tokens, logs, browser artefacts, and cached identity information. Defenders restrict access, classify sensitive files, and monitor for unusual reads from high-value paths.
What Common Resource Locations Are For
Common resource locations are predictable file paths where operating systems, applications, and browsers store data that is easy to overlook but often highly valuable. They matter because harvested files can reveal cached credentials, session material, logs, configuration files, and other identity-related artefacts.
For defenders, these paths are not interesting because they are “secret” by design, but because they are convenient collection points. The same consistency that makes them useful for legitimate software also makes them attractive for post-compromise discovery and bulk harvesting.
Why Attackers Target These Paths
Attackers look in standard locations first because they are efficient to search and often expose more than one useful item in a single read. A browser profile, application cache, or user data directory may contain tokens, saved preferences, service endpoints, or remnants of prior authenticated activity.
This behaviour is closely aligned with credential access and discovery activity in intrusion chains. The point is not always immediate login reuse; sometimes the objective is to assemble enough context to move laterally, identify high-value services, or locate additional secret-bearing files elsewhere on the host.
What Makes the Data Valuable
The risk is not only that a file contains a secret, but that ordinary-looking files can expose multiple security layers at once. Logs may reveal usernames, hostnames, URLs, API endpoints, or error traces; browser artefacts may expose sessions or federation traces; cached files may preserve material that should have expired or been discarded.
That combination makes these locations especially useful after an initial foothold. Even when the harvested data is not directly reusable, it can still support reconnaissance, secret hunting, and trust relationship mapping across applications and environments.
Defensive Visibility and Control
Protection starts with knowing which standard paths exist on each platform and which of them regularly contain sensitive material. Filesystem permissions, least-privilege access, application hardening, and sensible retention rules all reduce the value of these locations to an intruder.
Monitoring also matters because legitimate software may read these directories frequently. Defenders need baselines for normal access patterns, then alert on unusual recursive reads, unexpected archive creation, or access from processes that do not normally touch user or application data. Guidance on least-privilege access and auditability is reinforced by NIST SP 800-53 Rev 5 Security and Privacy Controls and the broader detection and response orientation of MITRE ATT&CK Enterprise Matrix.
Risk and Threat Considerations
These locations are high-risk because they concentrate sensitive artefacts in predictable places that an attacker can enumerate quickly after compromise. A single successful read can expose credentials, tokens, cached identity material, or enough contextual information to accelerate follow-on access.
Failure mechanism: predictable paths, broad local read access, and weak monitoring let an intruder harvest many useful files before defenders notice the access pattern.
Impact: the resulting exposure can enable session abuse, secret reuse, lateral movement, and faster discovery of additional assets or trust relationships.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Monitoring unusual reads from common paths depends on reviewable audit signals. |
| AC-6 — Least Privilege | Restricting access to sensitive directories directly reduces harvesting opportunities. | |
| Recommendation — Review file-access audit events for abnormal reads from high-value directories. Limit directory and file access to the minimum set of processes and users. | ||
| MITRE ATT&CK | T1217 — Browser Session Discovery | Harvesting common locations often seeks browser artefacts and cached session material. |
| T1005 — Data from Local System | The term describes collecting data from predictable local directories and caches. | |
| T1552 — Unsecured Credentials | Common resource locations often expose credentials, tokens, or keys left on disk. | |
| Recommendation — Hunt for browser-artefact collection and correlate it with post-compromise access. Detect local data collection from standard directories after initial access. Search for exposed secrets in local files and remove readable secret material. | ||
Practitioner Guidance
What to watch for: treat repeated reads from user profiles, browser stores, application caches, temp directories, and backup or export locations as a collection signal when they come from unexpected processes or accounts. The most useful control is usually not a single block, but a combination of data classification, path-level restriction, and alerting on abnormal file access.
Governance implication: teams should define which common paths may hold sensitive data, who owns them, and how long sensitive artefacts are allowed to persist there. That ownership question is often missed until an incident review shows that secrets, logs, and operational traces were never assigned a clear protective standard.