Collection Tactic in MITRE Mapping

CyberDefender 5 mins0

The Collection tactic in MITRE ATT&CK describes how adversaries gather data of interest from a target system before exfiltration. It represents the post-compromise stage where attackers already have some level of access and begin accumulating sensitive information.

Collection typically occurs after Discovery and Credential Access but before Exfiltration, and mapping Collection behaviors is essential for constructing a full attack chain.

1️⃣ Purpose of the Collection Tactic in MITRE Mapping

In MITRE ATT&CK–aligned analysis, mapping Collection techniques helps defenders:

✔ Build detection logic

Different tools (EDR, SIEM, DLP, logs) can be mapped to specific techniques, e.g., monitoring access to clipboard APIs for T1115 – Clipboard Data.

✔ Understand adversary objectives

Collection often reveals what attackers are after (e.g., intellectual property, credentials, financial data).

✔ Contextualize attack progression

Collection connects Discovery → Collection → Exfiltration, showing how data moves in an intrusion lifecycle.

2️⃣ Core MITRE Collection Techniques (Technical Breakdown)

Below are the main technique IDs in MITRE ATT&CK v14+ associated with TA0009 – Collection, with technical explanations relevant to defensive mapping.

📌 T1005 – Data from Local System

Attackers extract locally stored files, database contents, cached credentials, or application configuration files.

Examples (high-level, non-sensitive):

  • Reading files via legitimate OS APIs (Win32 API: ReadFile, Linux: open/read)
  • Using remote management utilities (e.g., WMI Get-WmiObject)
  • Copying browser profile directories or email PST files

Detection Mapping:

  • File access event logs
  • EDR telemetry for sensitive directory access
  • DLP file movement rules

📌 T1056 – Input Capture (keylogging & more)

This technique captures user input.

Sub-techniques:

  • T1056.001 – Keylogging
  • T1056.002 – GUI Input Capture
  • T1056.003 – Web Portal Login Capture
  • T1056.004 – Credential API Hooking

Technical behaviors:

  • API hooking of input functions (GetAsyncKeyState, SetWindowsHookEx)
  • Accessibility interface abuse (UIAutomation, AppleScript)
  • Browser form-grabbers

Detection Mapping:

  • API hooking anomalies
  • Suspicious process interaction with winlogon.exe or input devices
  • Excessive calls to input-capture APIs

📌 T1113 – Screen Capture

Capturing screen or window content.

Technical mechanisms:

  • Windows GDI APIs (BitBlt, GetDC)
  • macOS Quartz Display Services
  • Linux X11 screenshot captures

Detection Mapping:

  • Monitoring access to screen-capture APIs
  • EDR events showing headless or remote screenshot commands

📌 T1115 – Clipboard Data

Attackers capture content copied to the clipboard.

Technical mechanisms:

  • Windows APIs: GetClipboardData, OpenClipboard
  • macOS pasteboard services
  • Linux X11 clipboard access

Detection Mapping:

  • API call monitoring
  • Unusual clipboard polling frequency

📌 T1114 – Email Collection

Adversaries gather email from local clients or remote servers.

Sub-techniques:

  • T1114.001 – Local Email Client
  • T1114.002 – Remote Email Collection
  • T1114.003 – Email Forwarding Rule Manipulation

Technical mechanisms:

  • Parsing Outlook PST/OST files
  • Accessing Exchange/IMAP/POP3 mailboxes
  • Setting inbox rules via EWS/Graph API

📌 T1530 – Data from Cloud Storage

Attackers pull data from cloud provider storage systems.

Technical mechanisms:

  • Using stolen API credentials or OAuth tokens
  • Listing and downloading objects (e.g., AWS S3 ListObjectsV2 → GetObject)
  • Accessing OneDrive, Google Drive, Box, etc.

Detection Mapping:

  • Cloud audit logs (AWS CloudTrail, Azure Monitor, Google Cloud Audit Logs)
  • Impossible-travel or suspicious geo-location access alerts

📌 T1074 – Data Staged (Local or Remote)

Before exfiltration, attackers often aggregate data in staging areas.

Technical behaviors:

  • Compressing data (ZIP, RAR, 7z)
  • Collecting files into a temporary directory
  • Using cloud buckets as staging points

Detection Mapping:

  • Monitoring for compression tools
  • File creation in suspicious staging directories
  • Unusual archival file creation activity

CyberDefender