Home/ MITRE Matrix/ Collection/ T1119

T1119Automated Collection

T1119 — Automated Collection is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 8 detection use cases covering it and 5 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

5Articles

0Sub-techniques

1Tactic

Use cases covering this technique (8)

AWS Exfiltration via Anomalous GetObject API Activity ESCU actions · hunting P AWS Exfiltration via Batch Service ESCU actions · alerting P AWS Exfiltration via DataSync Task ESCU actions · alerting P Windows File Collection Via Copy Utilities ESCU actions · hunting P Windows Process Accessing Windows Recall Directory ESCU actions · hunting P [LLM] GoSerpent ThumbcacheService staging DB (thumbcache_605a.db) written to C:\Users\Public Bespoke actions · alerting DSΣPDDCS [LLM] MantisBT SOAP endpoint (mantisconnect.php) high-volume POST burst — mass data exfiltration Bespoke actions · alerting SP [LLM] Klue/Icarus: bulk Salesforce CRM record retrieval via connected app (Case/Contact/Account/Opportunity) Bespoke actions · alerting DSP

Articles citing this technique (5)

high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-154

crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-167

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301

high When a vendor's breach becomes yours: lessons from the Klue incident art-307

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455