Ctrl+K

T1119 - Automated Collection

T1119 - Automated Collection#

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools.

This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Atomic Tests#

Atomic Test #1 - Automated Collection Command PromptAutomated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection#

to see what was collected. Supported Platforms: windows#### Attack Commands: Run with command_prompt

mkdir %temp%\T1119_command_prompt_collection >nul 2>&1
dir c: /b /s .docx | findstr /e .docx
for /R c:\ %f in (*.docx) do copy /Y %f %temp%\T1119_command_prompt_collection

Invoke-AtomicTest T1119 -TestNumbers 1

Cleanup:#

del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1

Invoke-AtomicTest T1119 -TestNumbers 1 -Cleanup

Atomic Test #2 - Automated Collection PowerShellAutomated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection#

to see what was collected. Supported Platforms: windows#### Attack Commands: Run with powershell

New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force | Out-Null
Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection}

Invoke-AtomicTest T1119 -TestNumbers 2

Cleanup:#

Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore | Out-Null

Invoke-AtomicTest T1119 -TestNumbers 2 -Cleanup

Atomic Test #3 - Recon information for export with PowerShellcollect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt#

to see what was collected. Supported Platforms: windows#### Attack Commands: Run with powershell

Get-Service > $env:TEMP\T1119_1.txt
Get-ChildItem Env: > $env:TEMP\T1119_2.txt
Get-Process > $env:TEMP\T1119_3.txt

Invoke-AtomicTest T1119 -TestNumbers 3

Cleanup:#

Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore

Invoke-AtomicTest T1119 -TestNumbers 3 -Cleanup

Atomic Test #4 - Recon information for export with Command Promptcollect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt#

to see what was collected. Supported Platforms: windows#### Attack Commands: Run with command_prompt

sc query type=service > %TEMP%\T1119_1.txt
doskey /history > %TEMP%\T1119_2.txt
wmic process list > %TEMP%\T1119_3.txt
tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt

Invoke-AtomicTest T1119 -TestNumbers 4

Cleanup:#

del %TEMP%\T1119_1.txt >nul 2>&1
del %TEMP%\T1119_2.txt >nul 2>&1
del %TEMP%\T1119_3.txt >nul 2>&1
del %TEMP%\T1119_4.txt >nul 2>&1

Invoke-AtomicTest T1119 -TestNumbers 4 -Cleanup

Detection#

Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as Data Staged. As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell, as well as through cloud APIs and command line interfaces.

Shield Active Defense#

Pocket Litter#

Place data on a system to reinforce the legitimacy of the system or user.

Pocket Litter is data placed on a system to convince an adversary that the system and users are real. Pocket litter includes documents, registry entries, log history, browsing history, connection history, and other user data that one would expect to exist on a user’s computer. This content may overlap with Decoy Content, however Pocket Litter covers aspects beyond just content (e.g.: Installed Applications, source code, clutter on a system, etc.).

Opportunity#

In an adversary engagement scenario, there is an opportunity to seed content to influence an adversary’s behaviors, test their interest in specific topics, or add legitimacy to a system or environment.

Use Case#

A defender can stage a variety of pocket litter files to see if the adversary collect any of those files in an automated manner.

Procedures#

When staging a decoy system and user account, populate a user’s folders and web history to make it look realistic to an adversary. Stage a USB device with documents on a specific topic in order to see if they are exfiltrated by an adversary.

Contents