TA0009 · COLLECTION
Automated Collection
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detect it with
Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment.
Why it matters on shift
Automated Collection is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
Kill-chain context