T1119: Automated Collection

Description

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023)

This functionality could also be built into remote access tools.

This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Platforms

Mitigations (2)

Threat Groups (21)

ID	Group	Context
G0040	Patchwork	[Patchwork](https://attack.mitre.org/groups/G0040) developed a file stealer to search C:\ and collect files with certain extensions. [Patchwork](https...
G0045	menuPass	[menuPass](https://attack.mitre.org/groups/G0045) has used the Csvde tool to collect Active Directory files and data.(Citation: Symantec Cicada Novemb...
G0125	HAFNIUM	[HAFNIUM](https://attack.mitre.org/groups/G0125) has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.(Citation: Microsoft Silk Ty...
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log fi...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has deployed scripts on compromised systems that automatically scan for interesting documents...
G0121	Sidewinder	[Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to automatically collect system and network configuration information.(Citation: AT...
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) used custom batch scripts to collect files automatically from a targeted system.(Citation: Secu...
G0049	OilRig	[OilRig](https://attack.mitre.org/groups/G0049) has used automated collection.(Citation: Unit42 OilRig Playbook 2023)
G0081	Tropic Trooper	[Tropic Trooper](https://attack.mitre.org/groups/G0081) has collected information automatically using the adversary's [USBferry](https://attack.mitre....
G0004	Ke3chang	[Ke3chang](https://attack.mitre.org/groups/G0004) has performed frequent and scheduled data collection from victim networks.(Citation: Microsoft NICKE...
G0006	APT1	[APT1](https://attack.mitre.org/groups/G0006) used a batch script to perform a series of discovery techniques and saves it to a text file.(Citation: M...
G0142	Confucius	[Confucius](https://attack.mitre.org/groups/G0142) has used a file stealer to steal documents and images with the following extensions: txt, pdf, png,...
G1035	Winter Vivern	[Winter Vivern](https://attack.mitre.org/groups/G1035) delivered a PowerShell script capable of recursively scanning victim machines looking for vario...
G1039	RedCurl	[RedCurl](https://attack.mitre.org/groups/G1039) has used batch scripts to collect data.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
G0053	FIN5	[FIN5](https://attack.mitre.org/groups/G0053) scans processes on all victim systems in the environment and uses automated scripts to pull back the res...
G0114	Chimera	[Chimera](https://attack.mitre.org/groups/G0114) has used custom DLLs for continuous retrieval of data from memory.(Citation: NCC Group Chimera Januar...
G1003	Ember Bear	[Ember Bear](https://attack.mitre.org/groups/G1003) engages in mass collection from compromised systems during intrusions.(Citation: Cadet Blizzard em...
G1030	Agrius	[Agrius](https://attack.mitre.org/groups/G1030) used a custom tool, <code>sql.net4.exe</code>, to query SQL databases and then identify and extract pe...
G0007	APT28	[APT28](https://attack.mitre.org/groups/G0007) used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(...
G1055	VOID MANTICORE	[VOID MANTICORE](https://attack.mitre.org/groups/G1055) conducted large-scale data exfiltration in the Stryker operation, consistent with automated or...

Associated Software (48)

ID	Name	Type	Context
S0238	Proxysvc	Malware	[Proxysvc](https://attack.mitre.org/software/S0238) automatically collects data about the victim and sends it to the control server.(Citation: McAfee ...
S1078	RotaJakiro	Malware	Depending on the Linux distribution, [RotaJakiro](https://attack.mitre.org/software/S1078) executes a set of commands to collect device information an...
S0466	WindTail	Malware	[WindTail](https://attack.mitre.org/software/S0466) can identify and add files that possess specific file extensions to an array for archiving.(Citati...
S0239	Bankshot	Malware	[Bankshot](https://attack.mitre.org/software/S0239) recursively generates a list of files within a directory and sends them back to the control server...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) has a file searcher component that can automatically collect and archive files based on a predef...
S0622	AppleSeed	Malware	[AppleSeed](https://attack.mitre.org/software/S0622) has automatically collected data from USB drives, keystrokes, and screen images before exfiltrati...
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) can automatically archive collected data.(Citation: Red Canary NETWIRE January 2020)
S1101	LoFiSe	Malware	[LoFiSe](https://attack.mitre.org/software/S1101) can collect all the files from the working directory every three hours and place them into a passwor...
S0260	InvisiMole	Malware	[InvisiMole](https://attack.mitre.org/software/S0260) can sort and collect specific documents as well as generate a list of all files on a newly inser...
S0257	VERMIN	Malware	[VERMIN](https://attack.mitre.org/software/S0257) saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .(Citation: Uni...
S1109	PACEMAKER	Malware	[PACEMAKER](https://attack.mitre.org/software/S1109) can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's...
S1213	Lumma Stealer	Malware	[Lumma Stealer](https://attack.mitre.org/software/S1213) has automated collection of various information including cryptocurrency wallet details.(Cita...
S0090	Rover	Malware	[Rover](https://attack.mitre.org/software/S0090) automatically collects files from the local system and removable drives based on a predefined list of...
S0395	LightNeuron	Malware	[LightNeuron](https://attack.mitre.org/software/S0395) can be configured to automatically collect files under a specified directory.(Citation: ESET Li...
S1111	DarkGate	Malware	[DarkGate](https://attack.mitre.org/software/S1111) searches for stored credentials associated with cryptocurrency wallets and notifies the command an...
S0455	Metamorfo	Malware	[Metamorfo](https://attack.mitre.org/software/S0455) has automatically collected mouse clicks, continuous screenshots on the machine, and set timers t...
S0098	T9000	Malware	[T9000](https://attack.mitre.org/software/S0098) searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc,...
S0339	Micropsia	Malware	[Micropsia](https://attack.mitre.org/software/S0339) executes an RAR tool to recursively archive files based on a predefined list of file extensions (...
S0438	Attor	Malware	[Attor](https://attack.mitre.org/software/S0438) has automatically collected data about the compromised system.(Citation: ESET Attor Oct 2019)
S0538	Crutch	Malware	[Crutch](https://attack.mitre.org/software/S0538) can automatically monitor removable drives in a loop and copy interesting files.(Citation: ESET Crut...

References

• Mandiant Intelligence. (2023, September 14). Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety. Retrieved January 2, 2024.

Frequently Asked Questions

What is T1119 (Automated Collection)?

T1119 is a MITRE ATT&CK technique named 'Automated Collection'. It belongs to the Collection tactic(s). Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting...

How can T1119 be detected?

Detection of T1119 (Automated Collection) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1119?

There are 2 documented mitigations for T1119. Key mitigations include: Remote Data Storage, Encrypt Sensitive Information.

Which threat groups use T1119?

Known threat groups using T1119 include: Patchwork, menuPass, HAFNIUM, FIN6, Gamaredon Group, Sidewinder, Mustang Panda, OilRig.