ATT&CK technique
View on MITRE ATT&CK →
T1119
Automated Collection
Collection
14 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Database Dumping Activity | production | 2026-09-18 |
| elastic | GCP Pub/Sub Subscription Creation | production | 2026-09-18 |
| elastic | AWS EC2 Export Task | production | 2026-09-18 |
| splunk | Windows Dir Piped to Findstr Activity | production | 2026-07-30 |
| splunk | AWS Exfiltration via DataSync Task | production | 2026-05-13 |
| splunk | AWS Exfiltration via Anomalous GetObject API Activity | production | 2026-05-13 |
| splunk | AWS Exfiltration via Batch Service | production | 2026-05-13 |
| splunk | Windows File Collection Via Copy Utilities | production | 2026-05-13 |
| splunk | Windows Process Accessing Windows Recall Directory | production | 2026-05-13 |
| sigma | Shai-Hulud Malicious GitHub Workflow Creation | experimental | 2026-01-24 |
| sigma | Recon Information for Export with PowerShell | test | 2022-12-25 |
| sigma | Automated Collection Command PowerShell | test | 2022-12-25 |
| sigma | Automated Collection Command Prompt | test | 2022-11-11 |
| sigma | Recon Information for Export with Command Prompt | test | 2022-09-13 |