Automated Collection

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.^[29]

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.^[27]

Attor has automatically collected data about the compromised system.^[20]

BADNEWS monitors USB devices and copies files with certain extensions toa predefined directory.^[11]

Bankshot recursively generates a list of files within a directory and sends them back to the control server.^[7]

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.^[6]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[30]

FIN6 has used a script to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.^[26]

Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.^[31]

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.^[12]

Each time a new drive is inserted, InvisiMole generates a list of all files on the drive and stores it in an encrypted file.^[3]

LightNeuron can be configured to automatically collect files under a specified directory.^[18]

MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.^[21]

Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).^[4]

OilRig has used automated collection.^[25]

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.^[11]

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.^[19]

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.^[1]

Proxysvc automatically collects data about the victim and sends it to the control server.^[8]

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.^[22]

Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.^[9]

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.^[13][14]

ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.^[2]

T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.^[15]

TajMahal has the ability to index and compress files into a send queue for exfiltration.^[23]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[28]

Tropic Trooper has collected information automatically using the adversary's USBferry attack.^[32]

For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.^[10]

VERMIN saves each collected file with the automatically generated format {{0:dd-MM-yyyy}}.txt .^[5]

WindTail can identify and add files that possess specific file extensions to an array for archiving.^[24]

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.^[16][17]

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. Strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through Brute Force techniques.

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means.