Home/ MITRE Matrix/ Collection/ T1119

T1119Automated Collection

T1119 — Automated Collection is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 9 detection use cases covering it and 5 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

5Articles

0Sub-techniques

1Tactic

Use cases covering this technique (9)

AWS Exfiltration via Anomalous GetObject API Activity ESCU actions · hunting P AWS Exfiltration via Batch Service ESCU actions · alerting P AWS Exfiltration via DataSync Task ESCU actions · alerting P Windows Dir Piped to Findstr Activity ESCU actions · hunting P Windows File Collection Via Copy Utilities ESCU actions · hunting P Windows Process Accessing Windows Recall Directory ESCU actions · hunting P [LLM] Bulk cadastral record enumeration/scraping from DGFiP SPDC portal (apexappliext.dgfip.finances.gouv.fr) Bespoke actions · alerting SP [LLM] MantisBT SOAP endpoint (mantisconnect.php) high-volume POST burst — mass data exfiltration Bespoke actions · alerting SP [LLM] Klue/Icarus: bulk Salesforce CRM record retrieval via connected app (Case/Contact/Account/Opportunity) Bespoke actions · alerting DSP

Articles citing this technique (5)

med French tax authority data breach affects 678,000 individuals art-24

crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-266

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351

high When a vendor's breach becomes yours: lessons from the Klue incident art-356

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500