Home TacticsCollection

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0009

Collection

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from.

Associated Techniques(18)

T1557

Adversary-in-the-Middle

Adversaries may attempt to position themselves between two or more networked devices to support follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

3 sub-techniques

T1560

Archive Collected Data

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

3 sub-techniques

T1123

Audio Capture

An adversary can leverage a computer's peripheral devices or applications to capture audio recordings.

T1119

Automated Collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

T1185

Browser Session Hijacking

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information.

T1115

Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

T1530

Data from Cloud Storage

Adversaries may access data from improperly secured cloud storage.

T1602

Data from Configuration Repository

Adversaries may collect data related to managed devices from configuration repositories.

2 sub-techniques

T1213

Data from Information Repositories

Adversaries may leverage information repositories to mine valuable information.

4 sub-techniques

T1005

Data from Local System

Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data.

T1039

Data from Network Shared Drive

Adversaries may search network shares on computers they have compromised to find files of interest.

T1025

Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest.

T1074

Data Staged

Adversaries may stage collected data in a central location or directory prior to Exfiltration.

2 sub-techniques

T1114

Email Collection

Adversaries may target user email to collect sensitive information.

3 sub-techniques

T1056

Input Capture

Adversaries may use methods of capturing user input to obtain credentials or collect information.

4 sub-techniques

T1113

Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

T1125

Video Capture

An adversary can leverage a computer's peripheral devices or applications to capture video recordings.

T1092

Communication Through Removable Media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands.

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Collection

Associated Techniques(18)

Adversary-in-the-Middle

Archive Collected Data

Audio Capture

Automated Collection

Browser Session Hijacking

Clipboard Data

Data from Cloud Storage

Data from Configuration Repository

Data from Information Repositories

Data from Local System

Data from Network Shared Drive

Data from Removable Media

Data Staged

Email Collection

Input Capture

Screen Capture

Video Capture

Communication Through Removable Media