Local System File Exploration

The subject browses, searches, or navigates files stored on a local system to identify data of interest. This includes interaction with files located on endpoint storage such as workstation drives, cached directories, synchronized folders (e.g., cloud sync clients), or application-specific storage locations.

Local file exploration may involve directory traversal, use of operating system search functions, sorting or filtering file views, and opening or previewing files without immediate transfer. In many environments, locally stored data includes synchronized copies of cloud repositories, downloaded attachments, or cached sensitive information, making it a viable source for discovery activity prior to exfiltration.