Cyber Wiki Learning Path
MITRE ATT&CK®: Collection
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Collection objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
41 connected entries
ARP Cache Poisoning (T1557.002)
ARP Cache Poisoning (T1557.002) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK technique profile · IntermediateAdversary-in-the-Middle (T1557)
Adversary-in-the-Middle (T1557) is an Enterprise ATT&CK technique associated with Credential Access, Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateArchive Collected Data (T1560)
Archive Collected Data (T1560) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedArchive via Custom Method (T1560.003)
Archive via Custom Method (T1560.003) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedArchive via Library (T1560.002)
Archive via Library (T1560.002) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedArchive via Utility (T1560.001)
Archive via Utility (T1560.001) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK technique profile · IntermediateAudio Capture (T1123)
Audio Capture (T1123) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateAutomated Collection (T1119)
Automated Collection (T1119) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateBrowser Session Hijacking (T1185)
Browser Session Hijacking (T1185) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateClipboard Data (T1115)
An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.
ATT&CK sub-technique profile · AdvancedCode Repositories (T1213.003)
Code Repositories (T1213.003) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedConfluence (T1213.001)
Confluence (T1213.001) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedCredential API Hooking (T1056.004)
Credential API Hooking (T1056.004) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedCustomer Relationship Management Software (T1213.004)
Customer Relationship Management Software (T1213.004) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedDHCP Spoofing (T1557.003)
DHCP Spoofing (T1557.003) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK technique profile · IntermediateData Staged (T1074)
Data Staged (T1074) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData from Cloud Storage (T1530)
Data from Cloud Storage (T1530) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData from Configuration Repository (T1602)
Data from Configuration Repository (T1602) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData from Information Repositories (T1213)
Data from Information Repositories (T1213) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData from Local System (T1005)
An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.
ATT&CK technique profile · IntermediateData from Network Shared Drive (T1039)
Data from Network Shared Drive (T1039) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateData from Removable Media (T1025)
Data from Removable Media (T1025) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDatabases (T1213.006)
Databases (T1213.006) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK technique profile · IntermediateEmail Collection (T1114)
Email Collection (T1114) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedEmail Forwarding Rule (T1114.003)
Email Forwarding Rule (T1114.003) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedEvil Twin (T1557.004)
Evil Twin (T1557.004) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK sub-technique profile · AdvancedGUI Input Capture (T1056.002)
GUI Input Capture (T1056.002) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK technique profile · IntermediateInput Capture (T1056)
Input Capture (T1056) is an Enterprise ATT&CK technique associated with Collection, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedKeylogging (T1056.001)
Keylogging (T1056.001) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
ATT&CK sub-technique profile · AdvancedLocal Data Staging (T1074.001)
Local Data Staging (T1074.001) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedLocal Email Collection (T1114.001)
Local Email Collection (T1114.001) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedMessaging Applications (T1213.005)
Messaging Applications (T1213.005) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedName Resolution Poisoning and SMB Relay (T1557.001)
Name Resolution Poisoning and SMB Relay (T1557.001) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
ATT&CK sub-technique profile · AdvancedNetwork Device Configuration Dump (T1602.002)
Network Device Configuration Dump (T1602.002) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedRemote Data Staging (T1074.002)
Remote Data Staging (T1074.002) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedRemote Email Collection (T1114.002)
Remote Email Collection (T1114.002) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK sub-technique profile · AdvancedSNMP (MIB Dump) (T1602.001)
SNMP (MIB Dump) (T1602.001) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK technique profile · IntermediateScreen Capture (T1113)
An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.
ATT&CK sub-technique profile · AdvancedSharepoint (T1213.002)
Sharepoint (T1213.002) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
ATT&CK technique profile · IntermediateVideo Capture (T1125)
Video Capture (T1125) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedWeb Portal Capture (T1056.003)
Web Portal Capture (T1056.003) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.