Collection

Files, configs, and credentials harvested from the compromised host itself.

Detect it with
Mass file reads by a single non-indexing process; recursive directory traversal in command lines.

Adversaries may search connected removable media on computers they have compromised to find files of interest.

Detect it with
Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data.

Bulk reads from file servers and departmental shares.

Detect it with
One account opening thousands of files across shares in minutes; file server audit spikes.

Keyloggers and credential-prompt spoofing capturing what the user types.

Detect it with
SetWindowsHookEx usage; unexpected processes registering raw input devices.

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.

Detect it with
Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib.

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.

Detect it with
Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files.

Mailbox exports, forwarding rules, and delegated access used to siphon correspondence.

Detect it with
New inbox rules forwarding externally; New-MailboxExportRequest in Exchange audit logs.

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard .

Detect it with
Access to the clipboard is a legitimate function of many applications on an operating system. If an organization chooses to monitor for this behavior, then the data will likely need to be correlated against other suspicious or non-user-driven activity.

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Detect it with
Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment.

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Detect it with
Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information.

Detect it with
Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Detect it with
This may be a difficult technique to detect because adversary traffic may be masked by normal user traffic. New processes may not be created and no additional software dropped to disk.

Adversaries may leverage information repositories to mine valuable information.

Detect it with
As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial.

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage.

Detect it with
Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set that is allowing access to data.

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for…

Detect it with
Monitor network traffic for anomalies associated with known AiTM behavior. Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.

Compressing and encrypting the staged data to shrink it and hide its contents.

Detect it with
rar.exe / 7z.exe with a password flag; large archives written to temp or ProgramData.

Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Detect it with
Identify network traffic sent or received by untrusted hosts or networks that solicits and obtains the configuration information of the queried device.