T1119 Automated Collection — Attack Simulation

DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: path, access, actor, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0055",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "access": "read",
    "actor": "LAB\\analyst",
    "result": "success"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, path, action, size_bytes.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0039",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "path": "C:\\Lab\\demo.txt",
    "action": "create",
    "size_bytes": 64
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0029 collection page — Collect PowerShell 4104 with script-block ID and fragment sequence; instrument other engines separately rather than assigning them the same event ID.

Providers and collection configuration

• PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
• Sysmon process events: Interpreter launch and parent context, not full script content.
• Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

• Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
• Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
• On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: engine, script_block_id, fragment, fragments_total, script_text.

Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-PowerShell/Operational'
  Id = 4104
} -MaxEvents 5

Read-only check after Script Block Logging is configured. For PowerShell 7 use its registered PowerShellCore/Operational channel. Missing events are not proof of no execution; check policy, channel and permissions.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0029",
  "collector": "illustrative-lab-collector",
  "observation": {
    "engine": "PowerShell",
    "script_block_id": "lab-script-1",
    "fragment": 1,
    "fragments_total": 1,
    "script_text": "Write-Output \"LAB_TELEMETRY_CHECK\""
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.

Providers and collection configuration

• Microsoft Entra sign-in logs: Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.
• Cloud identity service audit: Issuer-side credential and administrative events where the service supports them.
• Application audit instrumentation: Application-side use of identities and sessions; design fields without raw tokens.

• Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.
• Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.
• Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately.

Required normalized fields: account, application, result, reason, source_ip.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0002",
  "collector": "illustrative-lab-collector",
  "observation": {
    "account": "analyst@example.test",
    "application": "lab-portal",
    "result": "failure",
    "reason": "invalid_credential",
    "source_ip": "192.0.2.10"
  }
}

Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.

MITRE detection strategy

4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Automated Collection Command PowerShell — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
• Recon Information for Export with PowerShell — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
• Automated Collection Command Prompt — test; category: process_creation; product: windows.
• Recon Information for Export with Command Prompt — test; product: windows; category: process_creation.

• S0090 Rover — malware.

  Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.[Palo Alto Rover]

  Exact relationship: relationship--121a09bd-f603-4476-a149-a3cba52f268c
• S0098 T9000 — malware.

  T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.[Palo Alto T9000 Feb 2016]

  Exact relationship: relationship--11bc3d01-fc44-415c-b5a3-5576f5cb6057
• S0128 BADNEWS — malware.

  BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.[TrendMicro Patchwork Dec 2017]

  Exact relationship: relationship--5027a119-ff43-4ca6-a862-3efe39b29b3e
• S0136 USBStealer — malware.

  For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.[ESET Sednit USBStealer 2014]

  Exact relationship: relationship--7a892ca0-f915-4dc1-817a-cdcfb6777f28
• S0148 RTM — malware.

  RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.[ESET RTM Feb 2017][Unit42 Redaman January 2019]

  Exact relationship: relationship--a83182d2-b619-4ca4-984b-21ecfe43da26
• S0170 Helminth — malware.

  A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.[Palo Alto OilRig May 2016]

  Exact relationship: relationship--cd58d271-9ee2-45d6-9ca3-22ae8da639b5
• S0198 NETWIRE — malware.

  NETWIRE can automatically archive collected data.[Red Canary NETWIRE January 2020]

  Exact relationship: relationship--394a227d-585f-48a5-84ac-cc40a0ad80e6
• S0238 Proxysvc — malware.

  Proxysvc automatically collects data about the victim and sends it to the control server.[McAfee GhostSecret]

  Exact relationship: relationship--4ed42682-d3ad-4a4f-8576-ccdf28ce642b
• S0239 Bankshot — malware.

  Bankshot recursively generates a list of files within a directory and sends them back to the control server.[McAfee Bankshot]

  Exact relationship: relationship--87648492-36d0-4f94-b318-17280b101678
• S0244 Comnie — malware.

  Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.[Palo Alto Comnie]

  Exact relationship: relationship--228e71e2-0e76-4020-a850-7a568412259b
• S0251 Zebrocy — malware.

  Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.[ESET Zebrocy Nov 2018][ESET Zebrocy May 2019]

  Exact relationship: relationship--e9a4ceb4-ed33-48c4-b1f3-f73883b0e207
• S0257 VERMIN — malware.

  VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .[Unit 42 VERMIN Jan 2018]

  Exact relationship: relationship--57a9c0ef-6b92-415e-9f72-a78483e35f5f
• S0260 InvisiMole — malware.

  InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.[ESET InvisiMole June 2018][ESET InvisiMole June 2020]

  Exact relationship: relationship--c87cbebf-6b1f-480d-802d-5a2004256183
• S0339 Micropsia — malware.

  Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).[Radware Micropsia July 2018]

  Exact relationship: relationship--12c94395-26b4-46a5-bb10-dab19b5f1a30
• S0363 Empire — tool.

  Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.[Talos Frankenstein June 2019]

  Exact relationship: relationship--4be42e8a-4547-43c5-97bf-01440994f95b
• S0378 PoshC2 — tool.

  PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.[GitHub PoshC2]

  Exact relationship: relationship--45d6e0d0-5de1-4382-ae08-acf4f035a740
• S0395 LightNeuron — malware.

  LightNeuron can be configured to automatically collect files under a specified directory.[ESET LightNeuron May 2019]

  Exact relationship: relationship--83d16911-5fa1-4646-9718-6af0852dcb9a
• S0428 PoetRAT — malware.

  PoetRAT used file system monitoring to track modification and enable automatic exfiltration.[Talos PoetRAT April 2020]

  Exact relationship: relationship--47aebf09-4bee-4639-94e3-27b095d7558a
• S0438 Attor — malware.

  Attor has automatically collected data about the compromised system.[ESET Attor Oct 2019]

  Exact relationship: relationship--982474f3-d61d-49ac-b5be-30553e872db1
• S0443 MESSAGETAP — malware.

  MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.[FireEye MESSAGETAP October 2019]

  Exact relationship: relationship--f60b8223-eea6-422e-99c6-7f9b70e8ea53
• S0445 ShimRatReporter — tool.

  ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.[FOX-IT May 2016 Mofang]

  Exact relationship: relationship--f47a9039-b5c0-49e5-9998-2820b075643f
• S0455 Metamorfo — malware.

  Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.[FireEye Metamorfo Apr 2018]

  Exact relationship: relationship--6caff042-f300-421c-b6c8-6c8dd6d69f1b
• S0458 Ramsay — malware.

  Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.[Eset Ramsay May 2020]

  Exact relationship: relationship--a6046634-68c8-4a9e-a58f-58fd8876346a
• S0466 WindTail — malware.

  WindTail can identify and add files that possess specific file extensions to an array for archiving.[objective-see windtail2 jan 2019]

  Exact relationship: relationship--7a6c1581-a077-4c8f-8111-3264fa9e1e9c
• S0467 TajMahal — malware.

  TajMahal has the ability to index and compress files into a send queue for exfiltration.[Kaspersky TajMahal April 2019]

  Exact relationship: relationship--5197fd7a-766f-45da-87f5-c469377460d1
• S0476 Valak — malware.

  Valak can download a module to search for and build a report of harvested credential data.[SentinelOne Valak June 2020]

  Exact relationship: relationship--7fb8ef27-0c19-4e31-9122-f89cd4283427
• S0491 StrongPity — malware.

  StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.[Bitdefender StrongPity June 2020]

  Exact relationship: relationship--8ec92ea1-6021-4e0f-9737-826e9f243830
• S0538 Crutch — malware.

  Crutch can automatically monitor removable drives in a loop and copy interesting files.[ESET Crutch December 2020]

  Exact relationship: relationship--c9e82790-f096-46f0-ba55-579d77ec3ea8
• S0597 GoldFinder — malware.

  GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.[MSTIC NOBELIUM Mar 2021]

  Exact relationship: relationship--b98063a7-6649-429f-8376-4d59499e7674
• S0622 AppleSeed — malware.

  AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.[KISA Operation Muzabi]

  Exact relationship: relationship--7f1c1e43-07dc-4deb-a27f-9f140a894c51
• S0684 ROADTools — tool.

  ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.[Roadtools]

  Exact relationship: relationship--34efccbe-b184-444d-8ce3-3a3e2bc2f988
• S0699 Mythic — tool.

  Mythic supports scripting of file downloads from agents.[Mythc Documentation]

  Exact relationship: relationship--bd651c13-04c8-4bff-9e68-b53b5f662510
• S1017 OutSteel — malware.

  OutSteel can automatically scan for and collect files with specific extensions.[Palo Alto Unit 42 OutSteel SaintBot February 2022 ]

  Exact relationship: relationship--82b85b1c-e6f8-443a-b64a-11b63907755f
• S1043 ccf32 — malware.

  ccf32 can be used to automatically collect files from a compromised host.[Bitdefender FunnyDream Campaign November 2020]

  Exact relationship: relationship--13183327-ca7a-4237-98be-c4c7215bf3d3
• S1044 FunnyDream — malware.

  FunnyDream can monitor files for changes and automatically collect them.[Bitdefender FunnyDream Campaign November 2020]

  Exact relationship: relationship--8f7fe970-0a16-4007-84ae-e7294d06595f
• S1078 RotaJakiro — malware.

  Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.[RotaJakiro 2021 netlab360 analysis]

  Exact relationship: relationship--dd380abd-e1d8-4c8a-bd87-6e7a110fe0b4
• S1091 Pacu — tool.

  Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.[GitHub Pacu]

  Exact relationship: relationship--e8edbb73-b8bf-42f5-85a3-091b3a4fd955
• S1101 LoFiSe — malware.

  LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.[Kaspersky ToddyCat Check Logs October 2023]

  Exact relationship: relationship--f3182645-cd5b-43af-b1ec-c1fb9e15f2af
• S1109 PACEMAKER — malware.

  PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.[Mandiant Pulse Secure Zero-Day April 2021]

  Exact relationship: relationship--8790dab9-2fc9-45cf-b46c-bbe2b1f2c20e
• S1111 DarkGate — malware.

  DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.[Ensilo Darkgate 2018]

  Exact relationship: relationship--1ab19016-645d-4176-b0f4-025990fd4b36
• S1131 NPPSPY — tool.

  NPPSPY collection is automatically recorded to a specified file on the victim machine.[Huntress NPPSPY 2022]

  Exact relationship: relationship--e71bcde1-03cd-46c3-ab59-aede8aefe8b9
• S1148 Raccoon Stealer — malware.

  Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.[S2W Racoon 2022][Sekoia Raccoon1 2022][Sekoia Raccoon2 2022]

  Exact relationship: relationship--a69fa027-82b4-4c29-90b0-37fffe680d8a
• S1183 StrelaStealer — malware.

  StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.[DCSO StrelaStealer 2022][PaloAlto StrelaStealer 2024][Fortgale StrelaStealer 2023][IBM StrelaStealer 2024]

  Exact relationship: relationship--ef704a2d-c73c-4cf1-947d-f70efbee6894
• S1213 Lumma Stealer — malware.

  Lumma Stealer has automated collection of various information including cryptocurrency wallet details.[Cybereason LumaStealer Undated]

  Exact relationship: relationship--bd88fffc-e2ca-4800-92cd-8061537fce16
• S9008 Shai-Hulud — malware.

  Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.[Aikido Shai-Hulud September 2025][Netskope Shai-Hulud November 2025][Microsoft Shai-Hulud December 2025]

  Exact relationship: relationship--7618d723-b62a-4dca-9b83-153410dcdda7
• S9035 LAMEHUG — malware.

  LAMEHUG can recursively copy files from targeted directories on victim hosts.[Splunk LAMEHUG SEP 2025][Nov AI Threat Tracker]

  Exact relationship: relationship--bab58303-c3d2-45c8-b175-e2cb6f19b720
• S9041 TeamPCP Cloud Stealer — malware.

  TeamPCP Cloud Stealer can identify and collect credentials across over 50 file paths in Cloud, CI/CD, developer tooling, and container enviornments.[Wiz Trivy Compromise MAR 2026][Aqua Security Blog Trivy Compromise APR 2026]

  Exact relationship: relationship--d7b8831f-948f-47a1-a751-01b5b81e13ea
• S9043 Mini Shai-Hulud — malware.

  Mini Shai-Hulud has the ability to automatically compile gathered credentials from configuration files and password vaults within an archive and exfiltrate stolen data leveraging both a primary and fallback C2.[Flashpoint Mini Shai-Hulud MAY 2026]

  Exact relationship: relationship--b6e78cd0-4bf6-486a-8133-4d04c154e61a
• S9050 Vidar — malware.

  Vidar has collected data using automated scripts within malicious executables.[QuorumCyber_Vidar_March2023]

  Exact relationship: relationship--6f918e2b-d89f-4cf1-8180-ef83b2674f10
• S9058 SIGHTGRAB — malware.

  SIGHTGRAB has autonomously captured screen shots at regular intervals.[Mandiant_UNC1549_Nov2025]

  Exact relationship: relationship--794cb340-3f00-4272-b7fc-b99295b09b73

Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection
to see what was collected.

Pinned Atomic procedure · 634bd9b9-dc83-4229-b19f-7f83ba9ad313 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.

Pinned Atomic procedure · aa1180e2-f329-4e1e-8625-2472ec0bfaf3 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt
to see what was collected.

Pinned Atomic procedure · c3f6d794-50dd-482f-b640-0384fbb7db26 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection
to see what was collected.

Pinned Atomic procedure · cb379146-53f1-43e0-b884-7ce2c635ff5b · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

• M1029 Remote Data Storage

  Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means.

• M1041 Encrypt Sensitive Information

  Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. Strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through Brute Force techniques.