Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Automated Collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

ID: T1119

Tactic(s): Collection

Platforms: IaaS, Linux, macOS, Office Suite, SaaS, Windows

Data Sources: Command: Command Execution, File: File Access, Script: Script Execution, User Account: User Account Authentication

Version: 1.3

Created: 31 May 2017

Last Modified: 25 Sep 2024

Name	Description
Procedure Examples
T9000	T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.(Citation: Palo Alto T9000 Feb 2016)
Rover	Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.(Citation: Palo Alto Rover)
Micropsia	Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).(Citation: Radware Micropsia July 2018)
ccf32	ccf32 can be used to automatically collect files from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
DarkGate	DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.(Citation: Ensilo Darkgate 2018)
Gamaredon Group	Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.(Citation: ESET Gamaredon June 2020)
Comnie	Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.(Citation: Palo Alto Comnie)
	During Operation Wocao, threat actors used a script to collect information about the infected system.(Citation: FoxIT Wocao December 2019)
ROADTools	ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.(Citation: Roadtools)
NETWIRE	NETWIRE can automatically archive collected data.(Citation: Red Canary NETWIRE January 2020)
Ember Bear	Ember Bear engages in mass collection from compromised systems during intrusions.(Citation: Cadet Blizzard emerges as novel threat actor)
RedCurl	RedCurl has used batch scripts to collect data.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
PoshC2	PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.(Citation: GitHub PoshC2)
PoetRAT	PoetRAT used file system monitoring to track modification and enable automatic exfiltration.(Citation: Talos PoetRAT April 2020)
Empire	Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.(Citation: Talos Frankenstein June 2019)
APT1	APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.(Citation: Mandiant APT1)
Proxysvc	Proxysvc automatically collects data about the victim and sends it to the control server.(Citation: McAfee GhostSecret)
BADNEWS	BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.(Citation: TrendMicro Patchwork Dec 2017)
TajMahal	TajMahal has the ability to index and compress files into a send queue for exfiltration.(Citation: Kaspersky TajMahal April 2019)
Ke3chang	Ke3chang has performed frequent and scheduled data collection from victim networks.(Citation: Microsoft NICKEL December 2021)
FIN5	FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.(Citation: Mandiant FIN5 GrrCON Oct 2016)
VERMIN	VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .(Citation: Unit 42 VERMIN Jan 2018)
Agrius	Agrius used a custom tool, `sql.net4.exe`, to query SQL databases and then identify and extract personally identifiable information.(Citation: Unit42 Agrius 2023)
Metamorfo	Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.(Citation: FireEye Metamorfo Apr 2018)
APT28	APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.(Citation: DOJ GRU Indictment Jul 2018)
WindTail	WindTail can identify and add files that possess specific file extensions to an array for archiving.(Citation: objective-see windtail2 jan 2019)
USBStealer	For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.(Citation: ESET Sednit USBStealer 2014)
AppleSeed	AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.(Citation: KISA Operation Muzabi)
Valak	Valak can download a module to search for and build a report of harvested credential data.(Citation: SentinelOne Valak June 2020)
OutSteel	OutSteel can automatically scan for and collect files with specific extensions.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
LightNeuron	LightNeuron can be configured to automatically collect files under a specified directory.(Citation: ESET LightNeuron May 2019)
Bankshot	Bankshot recursively generates a list of files within a directory and sends them back to the control server.(Citation: McAfee Bankshot)
PACEMAKER	PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.(Citation: Mandiant Pulse Secure Zero-Day April 2021)
Frankenstein	Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.(Citation: Talos Frankenstein June 2019)
StrongPity	StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.(Citation: Bitdefender StrongPity June 2020)
FunnyDream	FunnyDream can monitor files for changes and automatically collect them.(Citation: Bitdefender FunnyDream Campaign November 2020)
	APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.(Citation: Google Cloud APT41 2024)
Winter Vivern	Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.(Citation: CERT-UA WinterVivern 2023)
Attor	Attor has automatically collected data about the compromised system.(Citation: ESET Attor Oct 2019)
Confucius	Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.(Citation: TrendMicro Confucius APT Aug 2021)
OilRig	OilRig has used automated collection.(Citation: Unit42 OilRig Playbook 2023)
Ramsay	Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.(Citation: Eset Ramsay May 2020)
Raccoon Stealer	Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)(Citation: Sekoia Raccoon2 2022)
RTM	RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
	During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.(Citation: Talos Frankenstein June 2019)
FIN6	FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)
Patchwork	Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.(Citation: TrendMicro Patchwork Dec 2017)
Tropic Trooper	Tropic Trooper has collected information automatically using the adversary's USBferry attack.(Citation: TrendMicro Tropic Trooper May 2020)
Sidewinder	Sidewinder has used tools to automatically collect system and network configuration information.(Citation: ATT Sidewinder January 2021)
Chimera	Chimera has used custom DLLs for continuous retrieval of data from memory.(Citation: NCC Group Chimera January 2021)
GoldFinder	GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.(Citation: MSTIC NOBELIUM Mar 2021)
Threat Group-3390	Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)
Mythic	Mythic supports scripting of file downloads from agents.(Citation: Mythc Documentation)
Mustang Panda	Mustang Panda used custom batch scripts to collect files automatically from a targeted system.(Citation: Secureworks BRONZE PRESIDENT December 2019)
Operation Wocao	Operation Wocao has used a script to collect information about the infected system.(Citation: FoxIT Wocao December 2019)
InvisiMole	InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Crutch	Crutch can automatically monitor removable drives in a loop and copy interesting files.(Citation: ESET Crutch December 2020)
Helminth	A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.(Citation: Palo Alto OilRig May 2016)
RotaJakiro	Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.(Citation: RotaJakiro 2021 netlab360 analysis)
NPPSPY	NPPSPY collection is automatically recorded to a specified file on the victim machine.(Citation: Huntress NPPSPY 2022)
Pacu	Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.(Citation: GitHub Pacu)
Zebrocy	Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019)
menuPass	menuPass has used the Csvde tool to collect Active Directory files and data.(Citation: Symantec Cicada November 2020)
LoFiSe	LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.(Citation: Kaspersky ToddyCat Check Logs October 2023)
ShimRatReporter	ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.(Citation: FOX-IT May 2016 Mofang)
MESSAGETAP	MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.(Citation: FireEye MESSAGETAP October 2019)

Mitigation	Description
Mitigations
Remote Data Storage	Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.
Encrypt Sensitive Information	Protect sensitive information with strong encryption.
Automated Collection Mitigation	Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. A keylogger installed on a system may be able to intercept passwords through Input Capture and be used to decrypt protected documents that an adversary may have collected. Strong passwords should be used to prevent offline cracking of encrypted documents through Brute Force techniques. Identify unnecessary system utilities, third-party tools, or potentially malicious software that may be used to collect files and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Detection

Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as Data Staged. As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell, as well as through cloud APIs and command line interfaces.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Automated Collection

Procedure Examples

Mitigations

Detection

References

Связанные риски

Каталоги