collection — tactic tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• T0801 Monitor Process State · simulation
• T0802 Automated Collection · simulation
• T0811 Data from Information Repositories · simulation
• T0830 Adversary-in-the-Middle · simulation
• T0845 Program Upload · simulation
• T0852 Screen Capture · simulation
• T0861 Point & Tag Identification · simulation
• T0868 Detect Operating Mode · simulation
• T0877 I/O Image · simulation
• T0887 Wireless Sniffing · simulation
• T0893 Data from Local System · simulation
• T1005 Data from Local System · simulation
• T1025 Data from Removable Media · simulation
• T1039 Data from Network Shared Drive · simulation
• T1056 Input Capture · simulation
• T1056.001 Keylogging · simulation
• T1056.002 GUI Input Capture · simulation
• T1056.003 Web Portal Capture · simulation
• T1056.004 Credential API Hooking · simulation
• T1074 Data Staged · simulation
• T1074.001 Local Data Staging · simulation
• T1074.002 Remote Data Staging · simulation
• T1113 Screen Capture · simulation
• T1114 Email Collection · simulation
• T1114.001 Local Email Collection · simulation
• T1114.002 Remote Email Collection · simulation
• T1114.003 Email Forwarding Rule · simulation
• T1115 Clipboard Data · simulation
• T1119 Automated Collection · simulation
• T1123 Audio Capture · simulation
• T1125 Video Capture · simulation
• T1185 Browser Session Hijacking · simulation
• T1213 Data from Information Repositories · simulation
• T1213.001 Confluence · simulation
• T1213.002 Sharepoint · simulation
• T1213.003 Code Repositories · simulation
• T1213.004 Customer Relationship Management Software · simulation
• T1213.005 Messaging Applications · simulation
• T1213.006 Databases · simulation
• T1409 Stored Application Data · simulation
• T1414 Clipboard Data · simulation
• T1417 Input Capture · simulation
• T1417.001 Keylogging · simulation
• T1417.002 GUI Input Capture · simulation
• T1429 Audio Capture · simulation
• T1430 Location Tracking · simulation
• T1430.001 Remote Device Management Services · simulation
• T1430.002 Impersonate SS7 Nodes · simulation
• T1453 Abuse Accessibility Features · simulation
• T1512 Video Capture · simulation
• T1513 Screen Capture · simulation
• T1517 Access Notifications · simulation
• T1530 Data from Cloud Storage · simulation
• T1532 Archive Collected Data · simulation
• T1533 Data from Local System · simulation
• T1557 Adversary-in-the-Middle · simulation
• T1557.001 Name Resolution Poisoning and SMB Relay · simulation
• T1557.002 ARP Cache Poisoning · simulation
• T1557.003 DHCP Spoofing · simulation
• T1557.004 Evil Twin · simulation
• T1560 Archive Collected Data · simulation
• T1560.001 Archive via Utility · simulation
• T1560.002 Archive via Library · simulation
• T1560.003 Archive via Custom Method · simulation
• T1602 Data from Configuration Repository · simulation
• T1602.001 SNMP (MIB Dump) · simulation
• T1602.002 Network Device Configuration Dump · simulation
• T1616 Call Control · simulation
• T1636 Protected User Data · simulation
• T1636.001 Calendar Entries · simulation
• T1636.002 Call Log · simulation
• T1636.003 Contact List · simulation
• T1636.004 SMS Messages · simulation
• T1636.005 Accounts · simulation
• T1638 Adversary-in-the-Middle · simulation
• T1676 Linked Devices · simulation