MITRE ATT&CKtactic

TA0009 Collection

Published 2018-10-17 Modified 2024-09-05 Official page ↗
Domain
enterprise
Version
1.1
Created
2018-10-17

Description

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

Related

Referenced by MITRE ATT&CK · tactic (41)

  • T1213.006 Databases sub-technique
  • T1557.004 Evil Twin sub-technique
  • T1213.005 Messaging Applications sub-technique
  • T1213.004 Customer Relationship Management Software sub-technique
  • T1557.003 DHCP Spoofing sub-technique
  • T1213.003 Code Repositories sub-technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1074.002 Remote Data Staging sub-technique
  • T1560 Archive Collected Data technique
  • T1560.001 Archive via Utility sub-technique
  • T1560.002 Archive via Library sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1114.002 Remote Email Collection sub-technique
  • T1114.003 Email Forwarding Rule sub-technique
  • T1213.001 Confluence sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1056.001 Keylogging sub-technique
  • T1056.002 GUI Input Capture sub-technique
  • T1056.003 Web Portal Capture sub-technique
  • T1056.004 Credential API Hooking sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1557.001 Name Resolution Poisoning and SMB Relay sub-technique
  • T1530 Data from Cloud Storage technique
  • T1213 Data from Information Repositories technique
  • T1185 Browser Session Hijacking technique
Show all 41 ›