Home/ MITRE Matrix/ Collection/ T1119

T1119Automated Collection

T1119 — Automated Collection is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 9 detection use cases covering it and 4 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (9)

AWS Exfiltration via Anomalous GetObject API Activity ESCU actions · hunting P AWS Exfiltration via Batch Service ESCU actions · alerting P AWS Exfiltration via DataSync Task ESCU actions · alerting P Windows File Collection Via Copy Utilities ESCU actions · hunting P Windows Process Accessing Windows Recall Directory ESCU actions · hunting P [LLM] High-volume scripted access to Tchap Matrix endpoint (bulk public-room scraping) Bespoke actions · hunting DSPDDCS [LLM] s1ngularity nx: AI CLI assistant invoked with permission-bypass flags (Claude/Gemini/Q) Bespoke actions · alerting DSΣPDD [LLM] s1ngularity nx: /tmp/inventory.txt staging file created on host Bespoke actions · alerting DSΣPDD [LLM] GhostAction GitHub workflow secret-enumeration commit pattern Bespoke weapon · hunting DSPDDCS

Articles citing this technique (4)

med Over 73,000 French govt employees affected in Tchap messenger breach art-35

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-332

crit s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malware art-778

high GhostAction Campaign: Over 3,000 Secrets Stolen Through Malicious GitHub Workflows art-785