MITRE ATT&CKtechnique

T1119 Automated Collection

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
IaaS, Linux, macOS, Office Suite, SaaS, Windows
Version
1.4
Created
2017-05-31

Description

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1041 Encrypt Sensitive Information mitigation
  • M1029 Remote Data Storage mitigation

Referenced by MITRE ATT&CK · uses (78)

  • S9058 SIGHTGRAB software (malware)
  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9043 Mini Shai-Hulud software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • G1055 VOID MANTICORE group
  • S9008 Shai-Hulud software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • S1213 Lumma Stealer software (malware)
  • C0046 ArcaneDoor campaign
  • S1183 StrelaStealer software (malware)
  • G1039 RedCurl group
  • C0040 APT41 DUST campaign
  • S1148 Raccoon Stealer software (malware)
  • G1035 Winter Vivern group
  • G1030 Agrius group
  • S1131 NPPSPY software (tool)
  • S1111 DarkGate software (malware)
  • S1109 PACEMAKER software (malware)
  • S1101 LoFiSe software (malware)
  • S1091 Pacu software (tool)
  • S1078 RotaJakiro software (malware)
  • C0014 Operation Wocao campaign
  • S1044 FunnyDream software (malware)
  • S1043 ccf32 software (malware)
  • C0001 Frankenstein campaign
  • G1003 Ember Bear group
  • S1017 OutSteel software (malware)
Show all 78 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-150 Collect Data from Common Resource Locations attack pattern

Referenced by Compliance · mitigates (18)

  • CIS-3.11 Encrypt Sensitive Data At Rest CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SC-36 Distributed Processing and Storage NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-23 Information Fragmentation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References