T1119 — Automated Collection

Tactic: Collection · Platforms: IaaS, Linux, macOS, Office Suite, SaaS, Windows

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location,…

Sigma detection rules (4)

title: T1119 Automated Collection
id: eb95dbf4-d37e-435e-8877-9a2494b35e2d
description: 'Automated File and API Collection Detection Across Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, SuspiciousFileExtensions, ProcessCountThreshold.'
references:
  - https://attack.mitre.org/techniques/T1119
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.collection
  - attack.t1119

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_recursive_search:
    CommandLine|contains|all:
      - 'Get-ChildItem'
      - '-Recurse'

  selection_extension:
    CommandLine|contains:
      - '.doc'
      - '.pdf'
      - '.xls'

  selection_followon_action:
    CommandLine|contains:
      - 'Compress-Archive'
      - 'Copy-Item'

  condition: selection_recursive_search and selection_extension and selection_followon_action

falsepositives:
  - Legitimate document-indexing, backup, or DLP scanning tools that recursively enumerate and copy/archive files by extension in a single scripted pipeline.

level: medium

title: T1119 Automated Collection
id: 9c2f2c74-93db-41bd-ae7c-eb8d4e0a59f4
description: 'Automated File Collection Detection via Search-Then-Archive Chaining. The prior condition ("1 of selection*") let the bare tar/zip selection fire alone on any archive-tool invocation with zero qualifiers - no target path, no repetition signal - making it indistinguishable from routine backup/packaging activity despite this technique being defined by scripted/repeated collection. This version requires both the find-based file search AND a subsequent archiving step together, and the paired correlation rule below counts repeated archive-creation events within a short window to approximate genuine automated/looped collection rather than a single ad hoc backup. Tune using: AccessPath, ScriptInterpreterList.'
references:
  - https://attack.mitre.org/techniques/T1119
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.collection
  - attack.t1119

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/find'
    a1|contains:
      - '-name'
      - '-exec'
  selection_tar:
    type: EXECVE
    a0|endswith:
      - '/tar'
      - '/zip'

  condition: selection and selection_tar

falsepositives:
  - find piped into tar/zip is a routine backup and packaging pattern; use the paired correlation rule (repeated archive creation within a short window) to distinguish genuine scripted/automated collection from a single one-off backup.

level: low
---
title: T1119 Automated Collection - Repeated Archive Creation
id: 3a4b5c6d-7e8f-4a9b-8c0d-1e2f3a4b5c6d
description: 'Correlation companion for 9c2f2c74-93db-41bd-ae7c-eb8d4e0a59f4: counts repeated find-then-archive events from the same host within a 15-minute window, approximating the scripted/repeated collection behavior that a single event cannot establish.'
status: experimental
correlation:
  type: event_count
  rules:
    - 9c2f2c74-93db-41bd-ae7c-eb8d4e0a59f4
  timespan: 15m
  condition:
    gte: 3

level: medium

title: T1119 Automated Collection
id: f6c8fbff-0994-4d51-a360-b6b25b3cf44e
description: 'Automated File and API Collection Detection Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AutomationTool, ClipboardCheckRate.'
references:
  - https://attack.mitre.org/techniques/T1119
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.collection
  - attack.t1119

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains:
      - 'repeat'
      - 'do shell script'

  condition: selection

falsepositives:
  - Legitimate scheduled AppleScript automations for backups or reporting use repeat loops in the same way.

level: medium

title: T1119 Automated Collection
id: ab64534e-5d3b-4b6f-82c2-2b6b8754d292
description: 'Automated File and API Collection Detection Across Platforms. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: UserAgentFilter, ExpectedClientIPList, DeviceProperties.'
references:
  - https://attack.mitre.org/techniques/T1119
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.collection
  - attack.t1119

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ClientAppUsed: 'Browser'
  scripted:
    UserAgent|contains:
      - 'python-requests'
      - 'PowerShell'
      - 'Go-http-client'

  condition: selection and scripted

falsepositives:
  - Legitimate automation or reporting scripts authenticating with a service principal using a scripting HTTP client.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1119 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan