Cross-source coverage

T1119 / ATT&CK

Automated Collection

23 rules across 7 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.

This functionality could also be built into remote access tools.

This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Tactics
Collection
Platforms
IaaS · Linux · macOS · Office Suite · SaaS · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogazure:signinlogs

How MITRE says to detect it DET0186

Automated File and API Collection Detection Across Platforms

Windows Analytic 0531

Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 0532

Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open

macOS Analytic 0533

Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.

  • macos:unifiedlog logMessage contains pbpaste or osascript
  • macos:unifiedlog subsystem=launchservices

SaaS Analytic 0534

Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.

  • azure:signinlogs Operation=UserLogin

View on attack.mitre.org ↗

splunk/security_content

6 rules
Detection Severity Format
AWS Exfiltration via Anomalous GetObject API Activity Undefined SPL
AWS Exfiltration via Batch Service Undefined SPL
AWS Exfiltration via DataSync Task Undefined SPL
Windows Dir Piped to Findstr Activity Undefined SPL
Windows File Collection Via Copy Utilities Undefined SPL
Windows Process Accessing Windows Recall Directory Undefined SPL

SigmaHQ/sigma

5 rules
Detection Severity Format
Shai-Hulud Malicious GitHub Workflow Creation High Sigma
Automated Collection Command PowerShell Medium Sigma
Automated Collection Command Prompt Medium Sigma
Recon Information for Export with Command Prompt Medium Sigma
Recon Information for Export with PowerShell Medium Sigma

elastic/protections-artifacts

5 rules
Detection Severity Format
Environment Variable Secret Collection Undefined Elastic TOML
Exfiltration Data Staging in Temporary Directory via Osascript Undefined Elastic TOML
Information Stealer Collection via Find Undefined Elastic TOML
Multi-Value Secret Searching via Find Undefined Elastic TOML
Multi-Value Secret Searching via Grep Undefined Elastic TOML

elastic/detection-rules

3 rules
Detection Severity Format
AWS EC2 Export Task Medium Elastic TOML
GCP Pub/Sub Subscription Creation Low Elastic TOML
Potential Database Dumping Activity Low Elastic TOML

chronicle/detection-rules

2 rules
Detection Severity Format
detect_possible_discovery_and_collection_of_files Undefined YARA-L
detect_search_for_credentials_on_windows_operating_system Undefined YARA-L

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Exchange PowerShell Snapin Added (Normalized Process Events) Undefined KQL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell script recursively collected files from a filesystem search Low Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.