Cross-source coverage

T1119 / ATT&CK

Automated Collection

21 rules across 6 sources.

2 deprecated hidden · include

From MITRE ATT&CK 19.2

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.

This functionality could also be built into remote access tools.

This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Tactics: Collection
Platforms: IaaS · Linux · macOS · Office Suite · SaaS · Windows
Telemetry: WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogazure:signinlogs

How MITRE says to detect it DET0186

Automated File and API Collection Detection Across Platforms

Windows Analytic 0531

Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.

WinEventLog:Sysmon EventCode=1
WinEventLog:Sysmon EventCode=11

Linux Analytic 0532

Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.

auditd:SYSCALL execve
auditd:SYSCALL open

macOS Analytic 0533

Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.

macos:unifiedlog logMessage contains pbpaste or osascript
macos:unifiedlog subsystem=launchservices

SaaS Analytic 0534

Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.

azure:signinlogs Operation=UserLogin

View on attack.mitre.org ↗

splunk/security_content

6 rules

Detection	Severity	Format
AWS Exfiltration via Anomalous GetObject API Activity	Undefined	SPL
AWS Exfiltration via Batch Service	Undefined	SPL
AWS Exfiltration via DataSync Task	Undefined	SPL
Windows Dir Piped to Findstr Activity	Undefined	SPL
Windows File Collection Via Copy Utilities	Undefined	SPL
Windows Process Accessing Windows Recall Directory	Undefined	SPL

SigmaHQ/sigma

5 rules

Detection	Severity	Format
Shai-Hulud Malicious GitHub Workflow Creation	High	Sigma
Automated Collection Command PowerShell	Medium	Sigma
Automated Collection Command Prompt	Medium	Sigma
Recon Information for Export with Command Prompt	Medium	Sigma
Recon Information for Export with PowerShell	Medium	Sigma

elastic/protections-artifacts

5 rules

Detection	Severity	Format
Environment Variable Secret Collection	Undefined	Elastic TOML
Exfiltration Data Staging in Temporary Directory via Osascript	Undefined	Elastic TOML
Information Stealer Collection via Find	Undefined	Elastic TOML
Multi-Value Secret Searching via Find	Undefined	Elastic TOML
Multi-Value Secret Searching via Grep	Undefined	Elastic TOML

elastic/detection-rules

3 rules

Detection	Severity	Format
AWS EC2 Export Task	Medium	Elastic TOML
GCP Pub/Sub Subscription Creation	Low	Elastic TOML
Potential Database Dumping Activity	Low	Elastic TOML

Azure/Azure-Sentinel

1 rule

Detection	Severity	Format
Exchange PowerShell Snapin Added (Normalized Process Events)	Undefined	KQL

Wazuh Core Ruleset

1 rule

Detection	Severity	Format
Powershell script recursively collected files from a filesystem search	Low	Wazuh XML