Technique:  Automated Collection
AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.
It used a batch script to perform a series of discovery techniques and saves it to a text file.
It used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.
Attor has automatically collected data about the compromised system.
BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.
Bankshot recursively generates a list of files within a directory and sends them back to the control server.
ccf32 can be used to automatically collect files from a compromised host.
It has used custom DLLs for continuous retrieval of data from memory.
Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.
It has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.
Crutch can automatically monitor removable drives in a loop and copy interesting files.
Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.
It scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
It has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.
During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.
FunnyDream can monitor files for changes and automatically collect them.
It has deployed scripts on compromised systems that automatically scan for interesting documents.
GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.
A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.
InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.
It has performed frequent and scheduled data collection from victim networks.
LightNeuron can be configured to automatically collect files under a specified directory.
It has used the Csvde tool to collect Active Directory files and data.
MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.
Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.
Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).
It used custom batch scripts to collect files automatically from a targeted system.
Mythic supports scripting of file downloads from agents.
NETWIRE can automatically archive collected data.
It has used automated collection.
During Operation Wocao, threat actors used a script to collect information about the infected system.
OutSteel can automatically scan for and collect files with specific extensions.
Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.
It developed a file stealer to search C:\ and collect files with certain extensions. It also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.
PoetRAT used file system monitoring to track modification and enable automatic exfiltration.
PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.
Proxysvc automatically collects data about the victim and sends it to the control server.
Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.
ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.
Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.
Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.
It monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.
ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.
It has used tools to automatically collect system and network configuration information.
StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.
T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.
TajMahal has the ability to index and compress files into a send queue for exfiltration.
It ran a command to compile an archive of file types of interest from the victim user's directories.
It has collected information automatically using the adversary's USBferry attack.
For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.
Valak can download a module to search for and build a report of harvested credential data.
VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .
WindTail can identify and add files that possess specific file extensions to an array for archiving.
Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.