tfMITRE ATT&CK technique

Automated Collection T1119

Tactic: Collection
Platforms: IaaS, Linux, macOS, Office Suite, SaaS, Windows
Version: 1.4
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Praetorian; Arun Seelagan, CISA

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 8%

Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 7%

Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 8%

Tools & malware92nd percentile · 92% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Automated Collection MITRE reference T1119

Top 8%of all ATT&CK techniques for number of groups

21 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

RedCurlG1039 ↗

Has used batch scripts to collect data.1 2

created 2024-09-232 references

Winter VivernG1035 ↗

Delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.1

created 2024-07-291 referenceaka TA473

AgriusG1030 ↗

Used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.1

created 2024-05-211 referenceaka Pink Sandstorm

Ember BearG1003 ↗

Engages in mass collection from compromised systems during intrusions.1

created 2022-06-091 referenceaka UNC2589

ConfuciusG0142 ↗

Has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.1

created 2021-12-261 referenceaka Confucius APT

All 21 groups for this technique · 6 newest in this preview

Offense vs defense T1119

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 6Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 6

first rule: 2021 Q2 · 6 of 6 campaigns plotted

Automated Collection detection strategy DET0186

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Automated File and API Collection Detection Across Platforms

Enterprise

4 platforms

AN0531 · Windows

Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines the lookback period for identifying burst activity or patterns in process/file events.
SuspiciousFileExtensions	Tunable list of file extensions associated with collection (e.g., .pdf, .docx).
ProcessCountThreshold	The number of times a process executes before considered anomalous.

AN0532 · Linux

Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessPath	Tunable location for sensitive files like /home/*/Documents.
ScriptInterpreterList	Shells or scripting engines to monitor (e.g., bash, python, perl).

AN0533 · macOS

Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	subsystem=launchservices
Process CreationDC0032	macos:unifiedlog	logMessage contains pbpaste or osascript

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AutomationTool	Detectable script interpreters or clipboard tools (pbpaste, osascript).
ClipboardCheckRate	Threshold for how often clipboard access occurs within a given time window.

AN0534 · SaaS

Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	azure:signinlogs	Operation=UserLogin

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAgentFilter	Filter for scripting agents (e.g., Python, PowerShell) which may vary by org.
ExpectedClientIPList	Set of known internal or managed IPs to filter benign automation.
DeviceProperties	Expected managed device profiles used to detect unmanaged devices.

Tests4Executorscmd 2 · PowerShell 2Need elevation0 of 4Have prerequisites0Have cleanup4Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Automated Collection Command Prompt	windows	cmd	—	—	Yes
Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection to see what was collected. Attack command mkdir %temp%\T1119_command_prompt_collection >nul 2>&1 dir c: /b /s .docx \| findstr /e .docx for /R c:\ %f in (*.docx) do copy /Y %f %temp%\T1119_command_prompt_collection Cleanup command del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1 GUID27e3f61e-e42f-4009-b74c-9eb6b3aaeda9
02	Automated Collection PowerShell	windows	PowerShell	—	—	Yes
Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection to see what was collected. Attack command New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force \| Out-Null Get-ChildItem -Recurse -Include *.doc \| % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection} Cleanup command Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore \| Out-Null GUIDed4bed81-177c-42d9-a977-95246689b7ef
03	Recon information for export with PowerShell	windows	PowerShell	—	—	Yes
collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt to see what was collected. Attack command Get-Service > $env:TEMP\T1119_1.txt Get-ChildItem Env: > $env:TEMP\T1119_2.txt Get-Process > $env:TEMP\T1119_3.txt Cleanup command Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore GUID2c90ba7d-0099-4284-b1cd-a16a34d4c1fe
04	Recon information for export with Command Prompt	windows	cmd	—	—	Yes
collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt to see what was collected. Attack command sc query type=service > %TEMP%\T1119_1.txt doskey /history > %TEMP%\T1119_2.txt wmic process list > %TEMP%\T1119_3.txt tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt Cleanup command del %TEMP%\T1119_1.txt >nul 2>&1 del %TEMP%\T1119_2.txt >nul 2>&1 del %TEMP%\T1119_3.txt >nul 2>&1 del %TEMP%\T1119_4.txt >nul 2>&1 GUIDb24c5577-1d7b-4b9e-aa14-751341a1456e

Tests from Atomic Red Team (MIT licence) · technique definition

Automated Collection detections T1119

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs