Collection

Detection of Local Data Collection Prior to Exfiltration

• Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.
• Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
• Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.
• Collection of device configuration via CLI commands (e.g., `show running-config`, `copy flash`, `more`), often followed by TFTP/SCP transfers.

Detection of Data Access and Collection from Removable Media

• Adversary mounts a USB device and begins enumerating, copying, or compressing files using scripting engines, cmd, or remote access tools.
• Adversary mounts external drive to /media or /mnt then accesses or copies targeted data via shell, cp, or tar.
• Adversary attaches USB drive and accesses sensitive files using Finder, cp, or bash scripts.

Detection Strategy for Data from Network Shared Drive

• Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).
• Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.
• Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.

Behavioral Detection of Input Capture Across Platforms

• Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
• Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
• Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
• Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.

Detection of Data Staging Prior to Exfiltration

• Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.
• Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.
• Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.
• Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.

Detect Screen Capture via Commands and API Calls

• Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.
• Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.
• Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.

Email Collection via Local Email Access and Auto-Forwarding Behavior

• Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of.pst/.ost files, and network connections to external SMTP servers.
• Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.
• Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.
• Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.

Clipboard Data Access with Anomalous Context

• Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.
• Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.
• Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).

Automated File and API Collection Detection Across Platforms

• Automated execution of native utilities and scripts to discover, enumerate, and exfiltrate files and clipboard content. Focus is on detecting repeated file access, scripting engine use, and use of command-line utilities commonly leveraged by collection scripts.
• Repeated or automated access to user document directories or clipboard using shell scripts or utilities like xclip/pbpaste. Detectable via auditd syscall logs or osquery file events.
• Use of pbpaste, AppleScript, or third-party automation frameworks (e.g., Automator) to collect clipboard or file content in bursts. Observable via unified logs.
• Suspicious sign-ins to Graph API or sensitive resources using non-browser scripting agents (e.g., Python, PowerShell), often for programmatic access to mailbox or OneDrive content.

Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS

• Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.
• Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.
• Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.

Behavior-chain, platform-aware detection strategy for T1125 Video Capture

• A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g.,.mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.
• A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.
• A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes.mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.

Detect browser session hijacking via privilege, handle access, and remote thread into browsers

• Adversary gains high integrity or special privileges (e.g., SeDebugPrivilege), locates a running browser process, opens it with write/inject rights, and modifies it (e.g., CreateRemoteThread / DLL load) to inherit cookies/tokens or establish a browser pivot.

Abuse of Information Repositories for Data Collection

• Programmatic or excessive access to file shares, SharePoint, or database repositories by users not typically interacting with them. This includes abnormal access by privileged accounts, enumeration of large numbers of files, or downloads of sensitive content in bursts.
• Command-line tools (e.g., curl, rsync, wget, or custom Python scripts) used to scrape documentation systems or internal REST APIs. Unusual access patterns to knowledge base folders or shared team drives.
• Abuse of SaaS platforms such as Confluence, GitHub, SharePoint Online, or Slack to access excessive internal documentation or export source code/data. Includes use of tokens or browser automation from unapproved IPs.
• Access of mounted cloud shares or document repositories via browser, terminal, or Finder by users not typically interacting with those resources. Includes script-based enumeration or mass download.

Multi-Platform Cloud Storage Exfiltration Behavior Chain

• Spike in object access from new IAM user or role followed by data exfiltration to external IPs
• OAuth token granted to external app followed by download of high-volume files in OneDrive/Google Drive
• Internal user account accesses shared links outside org followed by mass file download

Detect Adversary-in-the-Middle via Network and Configuration Anomalies

• Detects suspicious DNS/ARP poisoning attempts, unauthorized modifications to registry/network configuration, or abnormal TLS downgrade activity. Correlates changes in system configuration with subsequent unusual network flows or authentication events.
• Detects unauthorized edits to /etc/hosts, /etc/resolv.conf, or suspicious ARP broadcasts. Correlates file modifications with subsequent unexpected network sessions or service creation.
• Detects unauthorized edits to system configuration profiles, unexpected certificate trust changes, or abnormal ARP/DNS patterns indicative of interception.
• Detects unauthorized firmware or configuration changes enabling adversary-in-the-middle positioning (e.g., route injection, DNS spoofing, SSL downgrade). Behavioral analytics focus on sudden changes to routing tables or image file integrity failures.

Detect Archiving and Encryption of Collected Data (T1560)

• Detects adversarial archiving of files prior to exfiltration by correlating execution of compression/encryption utilities (e.g., makecab.exe, rar.exe, 7z.exe, powershell Compress-Archive) with subsequent creation of large compressed or encrypted files.
• Detects adversarial archiving activity through invocation of utilities like tar, gzip, bzip2, or openssl used in non-administrative or unusual contexts. Correlates command execution patterns with file creation of compressed/encrypted outputs in staging directories (e.g., /tmp, /var/tmp).
• Detects use of macOS-native archiving or encryption tools (zip, ditto, hdiutil) for staging collected data. Identifies unexpected invocation of archive utilities by Office apps, browsers, or background daemons. Correlates file creation of.zip/.dmg containers with process lineage anomalies.

Detection Strategy for Data from Configuration Repository on Network Devices

• Defenders may observe adversary attempts to extract configuration data from management repositories by monitoring for anomalous SNMP queries, API calls, or protocol requests (e.g., NETCONF, RESTCONF) that enumerate system configuration.