TA0009 / Enterprise tactic
Collection
Official MITRE tacticThe adversary is trying to gather data of interest to their goal.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
17 techniques
- T1557Adversary-in-the-Middle4 sub-techniques
- T1560Archive Collected Data3 sub-techniques
- T1123Audio Capture
- T1119Automated Collection
- T1185Browser Session Hijacking
- T1115Clipboard Data
- T1530Data from Cloud Storage
- T1602Data from Configuration Repository2 sub-techniques
- T1213Data from Information Repositories6 sub-techniques
- T1005Data from Local System
- T1039Data from Network Shared Drive
- T1025Data from Removable Media
- T1074Data Staged2 sub-techniques
- T1114Email Collection3 sub-techniques
- T1056Input Capture4 sub-techniques
- T1113Screen Capture
- T1125Video Capture