Techniques to perform data collection

Before we look at specific collection techniques, let’s define exactly what we mean by the term collection. Earlier in Chapter 7, on the topic of network and key asset discovery, we looked at the different techniques that threat actors may use to obtain data about a system, infrastructure, users, credentials, disks, files, programs in use, and more. In the language of MITRE ATT&CK, these activities are mostly related to the Discovery tactic, which describes ways that adversaries can gain knowledge about the system and internal network. As for the Collection tactic, MITRE ATT&CK describes it as “techniques adversaries may use to gather information that is relevant to following through on the adversary’s objectives. Such techniques are descriptions of the sources from which threat actors may obtain data, the methods for acquiring that data, and the methods for preparing it for exfiltration.” We will take a similar...