Automated Collection

Automated Collection [T1119]

Information

• Name: Automated Collection

• ID: T1119

• Tactics: TA0009

Introduction

Automated Collection is a technique categorized within the MITRE ATT&CK framework under the tactic of Collection. It refers to adversaries employing automated scripts or tools to systematically gather sensitive information from compromised systems or networks. Such information typically includes credentials, user data, system configurations, network information, and documents. Automated collection allows attackers to efficiently scale their data-gathering operations, minimize detection risks, and rapidly exfiltrate valuable intelligence.

Deep Dive Into Technique

Automated Collection involves using scripts, malware components, or specialized tools to systematically discover and harvest sensitive data from victim systems. Attackers often leverage scripting languages such as Python, PowerShell, Bash, or built-in operating system utilities to automate the extraction process. Commonly targeted data includes:

• User credentials (password hashes, plaintext passwords, tokens)

• Email and messaging data

• Documents and files (PDF, DOCX, XLSX)

• System configuration details

• Browser history and cookies

• Network architecture and host information

• Keystroke logs and screenshots

Mechanisms frequently used include:

• Custom scripts and tools: Attackers develop or employ existing automated scripts/tools to search file systems, databases, and applications for sensitive information.

• Scheduled tasks and cron jobs: Automated scripts may be configured to run periodically to continuously collect updated information.

• Malware modules: Malware often includes automated data collection modules designed to harvest credentials, browser data, or files without further attacker interaction.

• Remote Access Tools (RATs): RATs frequently contain built-in functionality to automatically collect and exfiltrate sensitive data.

Real-world procedures often involve:

1. Deploying malware or scripts on victim machines.

2. Enumerating file systems, registry entries, and databases automatically.

3. Compressing and encrypting collected data to avoid detection.

4. Exfiltrating collected data via covert channels (HTTP, DNS tunneling, cloud storage).

When this Technique is Usually Used

Automated Collection is typically employed across multiple stages of an attack lifecycle, including but not limited to:

• Initial Access and Reconnaissance: Attackers may use automated scripts to quickly map out target networks, identify valuable assets, and gather reconnaissance data.

• Privilege Escalation and Credential Harvesting: Automated tools systematically collect credentials and authentication tokens to facilitate lateral movement and privilege escalation.

• Data Exfiltration and Persistence: Regular automated collection ensures continuous access to updated sensitive information, enabling long-term persistence and sustained data theft.

• Post-compromise Intelligence Gathering: Attackers automate data collection to rapidly assess compromised environments, understand network topology, and identify high-value targets.

• Cyber Espionage Operations: Nation-state actors frequently use automated collection to systematically gather intelligence from targeted organizations, governments, or critical infrastructure.

How this Technique is Usually Detected

Detection of Automated Collection techniques typically involves monitoring for anomalous behavior, unusual process activity, and specific indicators of compromise (IoCs). Effective detection strategies include:

• Endpoint Monitoring and EDR Tools:

  • Detecting unusual execution of scripting languages (PowerShell, Python, Bash).

  • Identifying unexpected automated processes, scheduled tasks, or cron jobs.

  • Monitoring suspicious file access patterns (mass file enumeration, rapid reads).

• Network Traffic Analysis:

  • Detecting unusual outbound traffic patterns indicative of automated exfiltration.

  • Identifying DNS tunneling, HTTP POST requests with large payloads, or connections to suspicious domains/IP addresses.

• Log Analysis and SIEM:

  • Correlating logs to detect automated credential dumping (e.g., LSASS memory access).

  • Identifying abnormal access to sensitive files, databases, and registry keys.

  • Alerting on unexpected process creations or script executions.

• Behavioral Analytics:

  • Detecting unusual file access rates and automated enumeration behaviors.

  • Identifying anomalous user activity patterns indicative of automated scripts.

Specific Indicators of Compromise (IoCs):

• Presence of suspicious scripts or executables (e.g., automated data collection scripts).

• Unusual scheduled tasks or cron jobs running data collection commands.

• Evidence of mass file enumeration or rapid file access patterns.

• Network connections to known malicious IP addresses or domains.

• Large volumes of compressed and encrypted files found in temporary directories.

Why it is Important to Detect This Technique

Early detection of Automated Collection is crucial due to the significant and wide-ranging impacts on organizations, including:

• Data Loss and Breach: Automated collection enables attackers to quickly and efficiently exfiltrate large volumes of sensitive data, causing severe financial, reputational, and legal consequences.

• Credential Compromise and Escalation: Automated harvesting of credentials can lead to lateral movement, privilege escalation, and persistent attacker footholds within networks.

• Operational Disruption: Continuous automated data collection can degrade system performance, disrupt business operations, and cause service outages.

• Privacy and Compliance Violations: Unauthorized automated data gathering frequently results in violations of data privacy regulations (GDPR, HIPAA, PCI DSS), leading to regulatory fines and legal liabilities.

• Long-term Persistence: Regular automated data collection allows attackers to maintain persistent access, adapt their tactics, and evade detection for prolonged periods.

Detecting automated collection early significantly reduces the potential impact by:

• Limiting attacker dwell time within networks.

• Preventing widespread data exfiltration and credential compromise.

• Minimizing business disruption and operational downtime.

• Ensuring compliance with regulatory standards and reducing legal risks.

Examples

Examples of real-world attacks involving Automated Collection include:

• APT29 (Cozy Bear):

  • Scenario: Cyber espionage operations targeting government and diplomatic entities.

  • Tools Used: Custom scripts, PowerShell Empire, Cobalt Strike.

  • Impact: Automated credential harvesting, email extraction, and exfiltration of sensitive diplomatic communications.

• FIN7 Group:

  • Scenario: Targeting retail and hospitality sectors to steal payment card data.

  • Tools Used: Custom malware and scripts to automate data harvesting from POS systems.

  • Impact: Automated collection and exfiltration of millions of credit card records resulting in significant financial losses.

• TrickBot Malware:

  • Scenario: Financial fraud operations targeting banking institutions and enterprises.

  • Tools Used: Automated modules designed to harvest credentials, banking information, and email data.

  • Impact: Massive automated collection leading to financial fraud, identity theft, and credential compromise across numerous organizations.

• Operation Cloud Hopper (APT10):

  • Scenario: Targeting Managed Service Providers (MSPs) to gain access to client networks.

  • Tools Used: Custom automated scripts to systematically collect intellectual property, credentials, and sensitive business data.

  • Impact: Large-scale automated data theft affecting multiple global enterprises, leading to significant intellectual property loss and reputational damage.