Which SIEM platforms have a T1119 detection rule?

df00tech provides T1119 (Automated Collection) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Automated Collection (T1119)?

Detecting Automated Collection requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1119 detection?

The T1119 detection is rated high severity with medium confidence.

What are common false positives for T1119?

Common false positives for T1119 include: Backup software agents (Veeam, Acronis, Windows Backup) performing scheduled recursive file enumeration and copy operations using robocopy or xcopy with standard recursive flags; Enterprise file sync and DLP agents (OneDrive sync client, SharePoint sync, Varonis, Symantec DLP) scanning for specific document types as part of classification and policy enforcement; IT administrators running robocopy or PowerShell Get-ChildItem for bulk file migrations, server decommissions, or departmental data reorganization projects.

T1119

Automated Collection

Collection Last updated: April 18, 2026

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or ETL services to automatically collect data. This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

What is T1119 Automated Collection?

Automated Collection (T1119) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Automated Collection, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Collection
Technique: T1119 Automated Collection
Canonical reference: https://attack.mitre.org/techniques/T1119/

Microsoft Sentinel / Defender

kusto

let SensitiveExtensions = dynamic([
  ".doc", ".docx", ".xls", ".xlsx", ".pdf", ".ppt", ".pptx",
  ".mdb", ".accdb", ".csv", ".pst", ".ost", ".kdbx", ".pfx",
  ".pem", ".p12", ".key", ".rtf", ".txt"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // PowerShell recursive document search and collection
    (FileName in~ ("powershell.exe", "pwsh.exe") and
     ProcessCommandLine has_any ("-Recurse", "Get-ChildItem", "GCI ", "gci ") and
     ProcessCommandLine has_any (SensitiveExtensions))
    or
    // CMD recursive file enumeration targeting document types
    (FileName =~ "cmd.exe" and
     ProcessCommandLine has "dir" and ProcessCommandLine has "/s" and
     ProcessCommandLine has_any (SensitiveExtensions))
    or
    // forfiles automated file processing
    (ProcessCommandLine has "forfiles" and
     ProcessCommandLine has_any (SensitiveExtensions))
    or
    // Mass file copy with recursive flags (bulk staging)
    (FileName =~ "robocopy.exe" and
     ProcessCommandLine has_any ("/s", "/e", "/S", "/E", "/MIR", "/mir"))
    or
    (FileName =~ "xcopy.exe" and ProcessCommandLine has_any ("/s", "/S"))
    or
    // Archive tools ingesting document collections (pre-exfiltration staging)
    (FileName in~ ("rar.exe", "winrar.exe") and
     ProcessCommandLine has_any (" a ", "-a", "/a") and
     ProcessCommandLine has_any (SensitiveExtensions))
    or
    (FileName =~ "7z.exe" and
     ProcessCommandLine has_any (" a ", "a ") and
     ProcessCommandLine has_any (SensitiveExtensions))
    or
    // Python file traversal and collection scripts
    (FileName in~ ("python.exe", "python3.exe") and
     ProcessCommandLine has_any ("os.walk", "glob.glob", "shutil.copy", "os.listdir", "scandir"))
    or
    // VBScript/JScript file collection via Scripting.FileSystemObject
    (FileName in~ ("wscript.exe", "cscript.exe") and
     ProcessCommandLine has_any ("GetFolder", "GetFile", "CopyFile", "MoveFile", "Files"))
)
| extend AutoColl_RecursiveSearch = ProcessCommandLine has_any ("-Recurse", "/s", "/S", "os.walk", "forfiles", "Get-ChildItem")
| extend AutoColl_SensitiveExt = ProcessCommandLine has_any (SensitiveExtensions)
| extend AutoColl_ArchiveTool = FileName in~ ("rar.exe", "winrar.exe", "7z.exe")
| extend AutoColl_MassCopy = FileName in~ ("robocopy.exe", "xcopy.exe")
| extend AutoColl_CredentialFiles = ProcessCommandLine has_any (".pfx", ".pem", ".p12", ".key", ".kdbx")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         AutoColl_RecursiveSearch, AutoColl_SensitiveExt, AutoColl_ArchiveTool,
         AutoColl_MassCopy, AutoColl_CredentialFiles
| sort by Timestamp desc

Detects automated data collection activity using Microsoft Defender for Endpoint DeviceProcessEvents. Identifies key patterns: PowerShell Get-ChildItem recursive searches targeting sensitive file extensions (documents, spreadsheets, PDFs, credential stores), CMD dir /s bulk enumeration, forfiles automated file processing, mass copy tools (robocopy/xcopy) with recursive flags, archive tools (RAR/7z) staging document collections pre-exfiltration, and Python/VBScript file traversal scripts. Enrichment fields classify the collection type by category to assist analyst triage and prioritization.

high severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

Backup software agents (Veeam, Acronis, Windows Backup) performing scheduled recursive file enumeration and copy operations using robocopy or xcopy with standard recursive flags
Enterprise file sync and DLP agents (OneDrive sync client, SharePoint sync, Varonis, Symantec DLP) scanning for specific document types as part of classification and policy enforcement
IT administrators running robocopy or PowerShell Get-ChildItem for bulk file migrations, server decommissions, or departmental data reorganization projects
Software developers using Python scripts with os.walk or glob.glob for build processes, automated test data preparation, or log parsing pipelines
Anti-virus and endpoint security products performing scheduled content-inspection scans that enumerate files by extension type across user directories

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval cmdline=lower(CommandLine), proc=lower(Image)
| eval RecursiveSearch=if(match(cmdline, "(get-childitem|gci |-recurse|dir /s|forfiles|os\.walk|glob\.glob|scandir)"), 1, 0)
| eval SensitiveExt=if(match(cmdline, "(\.docx?|\.xlsx?|\.pdf|\.pptx?|\.pst|\.ost|\.mdb|\.accdb|\.kdbx|\.pfx|\.pem|\.p12|\.key|\.csv)"), 1, 0)
| eval ArchiveTool=if(match(proc, "(rar\.exe|winrar\.exe|7z\.exe)"), 1, 0)
| eval MassCopy=if(match(proc, "(robocopy\.exe|xcopy\.exe)") AND match(cmdline, "(/s|/e|/mir)"), 1, 0)
| eval ScriptInterpreter=if(match(proc, "(powershell\.exe|pwsh\.exe|python[23]?\.exe|wscript\.exe|cscript\.exe)"), 1, 0)
| eval CredentialFiles=if(match(cmdline, "(\.pfx|\.pem|\.p12|\.key|\.kdbx)"), 1, 0)
| eval SuspicionScore=RecursiveSearch + SensitiveExt + ArchiveTool + MassCopy + CredentialFiles
| where (ScriptInterpreter=1 AND RecursiveSearch=1 AND SensitiveExt=1)
    OR MassCopy=1
    OR (ArchiveTool=1 AND SensitiveExt=1)
    OR SuspicionScore >= 2
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        RecursiveSearch, SensitiveExt, ArchiveTool, MassCopy, CredentialFiles, SuspicionScore
| sort - SuspicionScore, - _time

Detects automated collection patterns using Sysmon Event ID 1 (Process Creation). Assigns a suspicion score based on: recursive search commands (Get-ChildItem, dir /s, forfiles, os.walk), sensitive file extension targeting (.docx, .xlsx, .pdf, .pst, .kdbx, .pfx), archive tool invocation (RAR, 7z, WinRAR) with document targets, mass copy tools (robocopy/xcopy) with recursive flags, and credential file targeting. Scoring approach helps analysts prioritize higher-confidence events. Results sorted by suspicion score descending, then most recent first.

high severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Backup software agents (Veeam, Acronis, Windows Backup) performing scheduled recursive file enumeration and copy operations using robocopy or xcopy with standard recursive flags
Enterprise file sync and DLP agents (OneDrive sync client, SharePoint sync, Varonis, Symantec DLP) scanning for specific document types as part of classification and policy enforcement
IT administrators running robocopy or PowerShell Get-ChildItem for bulk file migrations, server decommissions, or departmental data reorganization projects
Software developers using Python scripts with os.walk or glob.glob for build processes, automated test data preparation, or log parsing pipelines
Anti-virus and endpoint security products performing scheduled content-inspection scans that enumerate files by extension type across user directories

Elastic Security (EQL)

eql

process where event.type == "start" and
(
  // PowerShell recursive document search
  (process.name in~ ("powershell.exe", "pwsh.exe") and
   process.args : ("-Recurse", "Get-ChildItem", "GCI") and
   process.command_line : ("*.doc*", "*.xls*", "*.pdf", "*.ppt*", "*.pst", "*.ost", "*.mdb", "*.accdb", "*.csv", "*.kdbx", "*.pfx", "*.pem", "*.p12", "*.key", "*.rtf", "*.txt"))
  or
  // CMD recursive file enumeration
  (process.name == "cmd.exe" and
   process.command_line : "*dir*" and process.command_line : "*/s*" and
   process.command_line : ("*.doc*", "*.xls*", "*.pdf", "*.ppt*", "*.pst", "*.ost", "*.mdb", "*.csv", "*.kdbx"))
  or
  // forfiles automated processing
  (process.command_line : "*forfiles*" and
   process.command_line : ("*.doc*", "*.xls*", "*.pdf", "*.pst", "*.kdbx", "*.pfx", "*.pem"))
  or
  // Mass file copy tools
  (process.name == "robocopy.exe" and process.command_line : ("*/s*", "*/e*", "*/MIR*", "*/mir*"))
  or
  (process.name == "xcopy.exe" and process.command_line : "*/s*")
  or
  // Archive tools with document targets
  (process.name in~ ("rar.exe", "winrar.exe") and
   process.command_line : ("* a *", "-a ", "/a ") and
   process.command_line : ("*.doc*", "*.pdf", "*.pst", "*.kdbx", "*.pfx"))
  or
  (process.name == "7z.exe" and
   process.command_line : ("* a *", "a ") and
   process.command_line : ("*.doc*", "*.pdf", "*.pst", "*.kdbx", "*.pfx"))
  or
  // Python file traversal
  (process.name in~ ("python.exe", "python3.exe") and
   process.command_line : ("*os.walk*", "*glob.glob*", "*shutil.copy*", "*scandir*"))
  or
  // WScript/CScript with FSO methods
  (process.name in~ ("wscript.exe", "cscript.exe") and
   process.command_line : ("*GetFolder*", "*GetFile*", "*CopyFile*", "*MoveFile*", "*Files*"))
)

Detects automated data collection activity (T1119) including recursive file enumeration via PowerShell/CMD, mass file copying via robocopy/xcopy, archiving of sensitive file types, and scripted traversal via Python or WScript/CScript using Elastic ECS process events.

high severity high confidence

Data Sources

Endpoint Windows Event Logs Sysmon via Elastic Agent Elastic Endpoint Security

Required Tables

logs-endpoint.events.process-* winlogbeat-* logs-windows.sysmon_operational-*

False Positives

Backup software agents (e.g., Veeam, Acronis, Windows Backup) that recursively copy or archive documents on a schedule
IT asset management or DLP tools that use PowerShell Get-ChildItem with file extension filters during scheduled scans
Software deployment tooling (e.g., SCCM, PDQ Deploy) that uses robocopy or xcopy with recursive flags for application staging

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  sourceip,
  username,
  "QIDNAME"(qid) AS event_name,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 40)  -- Windows Security, Sysmon, WinCollect
  AND (CATEGORYNAME(category) LIKE '%Process%' OR qid IN (5001, 5002))  -- Process creation events
  AND starttime > (CURRENT_TIMESTAMP - 86400000)  -- Last 24 hours
  AND (
    -- PowerShell recursive collection
    (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
    AND (
      LOWER("Command") LIKE '%-recurse%' OR LOWER("Command") LIKE '%get-childitem%' OR LOWER("Command") LIKE '%gci %'
    )
    AND (
      LOWER("Command") LIKE '%.doc%' OR LOWER("Command") LIKE '%.pdf%' OR LOWER("Command") LIKE '%.pst%'
      OR LOWER("Command") LIKE '%.kdbx%' OR LOWER("Command") LIKE '%.pfx%' OR LOWER("Command") LIKE '%.pem%'
      OR LOWER("Command") LIKE '%.xls%' OR LOWER("Command") LIKE '%.csv%'
    )
  )
  OR (
    -- CMD dir /s with sensitive extensions
    LOWER("Process Name") LIKE '%cmd.exe%'
    AND LOWER("Command") LIKE '%dir%'
    AND LOWER("Command") LIKE '%/s%'
    AND (
      LOWER("Command") LIKE '%.doc%' OR LOWER("Command") LIKE '%.pdf%'
      OR LOWER("Command") LIKE '%.pst%' OR LOWER("Command") LIKE '%.xls%'
    )
  )
  OR (
    -- forfiles processing
    LOWER("Command") LIKE '%forfiles%'
    AND (
      LOWER("Command") LIKE '%.doc%' OR LOWER("Command") LIKE '%.pdf%'
      OR LOWER("Command") LIKE '%.pst%' OR LOWER("Command") LIKE '%.kdbx%'
    )
  )
  OR (
    -- robocopy mass copy
    LOWER("Process Name") LIKE '%robocopy.exe%'
    AND (
      LOWER("Command") LIKE '%/s%' OR LOWER("Command") LIKE '%/e%'
      OR LOWER("Command") LIKE '%/mir%'
    )
  )
  OR (
    -- Archive tools targeting documents
    (LOWER("Process Name") LIKE '%rar.exe%' OR LOWER("Process Name") LIKE '%winrar.exe%' OR LOWER("Process Name") LIKE '%7z.exe%')
    AND (
      LOWER("Command") LIKE '% a %' OR LOWER("Command") LIKE '%-a %'
    )
    AND (
      LOWER("Command") LIKE '%.doc%' OR LOWER("Command") LIKE '%.pdf%'
      OR LOWER("Command") LIKE '%.pst%' OR LOWER("Command") LIKE '%.kdbx%'
    )
  )
  OR (
    -- Python file traversal
    (LOWER("Process Name") LIKE '%python.exe%' OR LOWER("Process Name") LIKE '%python3.exe%')
    AND (
      LOWER("Command") LIKE '%os.walk%' OR LOWER("Command") LIKE '%glob.glob%'
      OR LOWER("Command") LIKE '%shutil.copy%' OR LOWER("Command") LIKE '%scandir%'
    )
  )
ORDER BY starttime DESC

Detects automated data collection (T1119) in IBM QRadar by querying process creation events from Windows Security, Sysmon, and WinCollect log sources. Identifies recursive file enumeration via PowerShell/CMD, mass copy operations with robocopy, document archiving via RAR/7z, and Python-based file traversal scripts.

high severity medium confidence

Data Sources

Windows Security Event Log (Event ID 4688) Sysmon (Event ID 1) WinCollect Agent

Required Tables

events

False Positives

Enterprise backup agents (Veeam, Commvault, NetBackup) performing scheduled recursive file copies with archive compression
Security scanning tools and DLP agents that enumerate file types across directories during scheduled policy checks
System administrators running legitimate robocopy or xcopy scripts for server migrations or file server restructuring

Sumo Logic CSE

sql

_sourceCategory="windows/sysmon" OR _sourceCategory="os/windows/security"
| where EventID = "1" OR EventID = "4688"
| parse field=CommandLine "*" as cmdline nodrop
| parse field=Image "*" as process_image nodrop
| eval cmdline_lower = toLowerCase(cmdline)
| eval proc_lower = toLowerCase(process_image)
// Flag recursive file search patterns
| eval RecursiveSearch = if (
    cmdline_lower matches "*(get-childitem|gci |-recurse|dir /s|forfiles|os\.walk|glob\.glob|scandir)*",
    1, 0
  )
// Flag sensitive file extensions
| eval SensitiveExt = if (
    cmdline_lower matches "*(\.docx?|\.xlsx?|\.pdf|\.pptx?|\.pst|\.ost|\.mdb|\.accdb|\.kdbx|\.pfx|\.pem|\.p12|\.key|\.csv)*",
    1, 0
  )
// Flag archive tools
| eval ArchiveTool = if (
    proc_lower matches "*(rar\.exe|winrar\.exe|7z\.exe)*",
    1, 0
  )
// Flag mass copy operations
| eval MassCopy = if (
    proc_lower matches "*(robocopy\.exe|xcopy\.exe)*"
    and cmdline_lower matches "*(/s|/e|/mir)*",
    1, 0
  )
// Flag script interpreters
| eval ScriptInterpreter = if (
    proc_lower matches "*(powershell\.exe|pwsh\.exe|python[23]?\.exe|wscript\.exe|cscript\.exe)*",
    1, 0
  )
// Flag credential-adjacent file types
| eval CredentialFiles = if (
    cmdline_lower matches "*(\.pfx|\.pem|\.p12|\.key|\.kdbx)*",
    1, 0
  )
// Composite suspicion score
| eval SuspicionScore = RecursiveSearch + SensitiveExt + ArchiveTool + MassCopy + CredentialFiles
// Apply detection logic
| where (ScriptInterpreter = 1 and RecursiveSearch = 1 and SensitiveExt = 1)
    or MassCopy = 1
    or (ArchiveTool = 1 and SensitiveExt = 1)
    or SuspicionScore >= 2
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine,
         RecursiveSearch, SensitiveExt, ArchiveTool, MassCopy, CredentialFiles, SuspicionScore
| sort by SuspicionScore desc, _messageTime desc

Detects automated data collection (T1119) in Sumo Logic by parsing Sysmon Event ID 1 and Security Event ID 4688 process creation logs. Uses a suspicion scoring model to identify recursive enumeration via PowerShell/CMD/Python, mass copy operations, and document archiving with sensitive file type targeting.

high severity high confidence

Data Sources

Sysmon via Sumo Logic Windows Collector Windows Security Event Log via Sumo Logic Collector

Required Tables

Sumo Logic _sourceCategory windows/sysmon Sumo Logic _sourceCategory os/windows/security

False Positives

Automated backup jobs using PowerShell scripts with Get-ChildItem and robocopy to copy document libraries to network shares
Enterprise DLP or CASB agents performing scheduled file classification scans that enumerate by extension across local drives
Developer build pipelines or CI scripts that use Python os.walk or glob to collect artifacts for packaging

Google Chronicle / SecOps

yaral

rule automated_collection_t1119 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects automated data collection (T1119) via recursive file enumeration, mass copy tools, document archiving, and scripted file traversal targeting sensitive file types"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1119"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"

    // Match on known collection patterns with sensitive extensions or recursive flags
    (
      // PowerShell recursive document search
      (
        re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`)
        and re.regex($e.principal.process.command_line, `(?i)(-Recurse|Get-ChildItem|\bGCI\b|forfiles)`)
        and re.regex($e.principal.process.command_line, `(?i)\.(docx?|xlsx?|pdf|pptx?|pst|ost|mdb|accdb|kdbx|pfx|pem|p12|key|csv)`)
      )
      or
      // CMD recursive enumeration targeting document types
      (
        re.regex($e.principal.process.file.full_path, `(?i)cmd\.exe$`)
        and re.regex($e.principal.process.command_line, `(?i)dir\s.*/s`)
        and re.regex($e.principal.process.command_line, `(?i)\.(docx?|xlsx?|pdf|pst|kdbx|pfx|pem)`)
      )
      or
      // robocopy mass copy with recursive flags
      (
        re.regex($e.principal.process.file.full_path, `(?i)robocopy\.exe$`)
        and re.regex($e.principal.process.command_line, `(?i)(/s|/e|/MIR)`)
      )
      or
      // xcopy recursive staging
      (
        re.regex($e.principal.process.file.full_path, `(?i)xcopy\.exe$`)
        and re.regex($e.principal.process.command_line, `(?i)/s`)
      )
      or
      // Archive tools compressing sensitive documents
      (
        re.regex($e.principal.process.file.full_path, `(?i)(rar\.exe|winrar\.exe|7z\.exe)$`)
        and re.regex($e.principal.process.command_line, `(?i)(\sa\s|-a\s|/a\s)`)
        and re.regex($e.principal.process.command_line, `(?i)\.(docx?|xlsx?|pdf|pst|kdbx|pfx|pem|p12|key|csv)`)
      )
      or
      // Python-based file traversal and collection
      (
        re.regex($e.principal.process.file.full_path, `(?i)python[23]?\.exe$`)
        and re.regex($e.principal.process.command_line, `(?i)(os\.walk|glob\.glob|shutil\.copy|scandir|os\.listdir)`)
      )
      or
      // WScript/CScript using Scripting.FileSystemObject
      (
        re.regex($e.principal.process.file.full_path, `(?i)(wscript\.exe|cscript\.exe)$`)
        and re.regex($e.principal.process.command_line, `(?i)(GetFolder|GetFile|CopyFile|MoveFile|Files)`)
      )
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting automated data collection (T1119) via UDM process launch events. Covers PowerShell/CMD recursive enumeration with sensitive file extensions, robocopy/xcopy mass copying, RAR/7z archiving of documents, Python os.walk traversal, and WScript/CScript FileSystemObject usage.

high severity high confidence

Data Sources

Google Chronicle UDM Windows Endpoint Telemetry ingested into Chronicle Microsoft Defender for Endpoint via Chronicle integration

Required Tables

UDM events with metadata.event_type = PROCESS_LAUNCH

False Positives

Enterprise backup software (Veeam, Backup Exec) that launches robocopy or PowerShell with Get-ChildItem on a schedule to replicate document repositories
IT operations scripts for data migration projects using xcopy or robocopy with recursive flags to move file shares between servers
Developer tooling or CI/CD pipelines using Python glob or os.walk to collect source files or build artifacts for packaging

CrowdStrike LogScale (CQL)

cql

// T1119 - Automated Collection: Recursive enumeration, mass copy, and document archiving
#event_simpleName = ProcessRollup2
| eval cmdline_lower = lowercase(CommandLine)
| eval proc_lower = lowercase(FileName)
// Detect recursive search patterns
| eval RecursiveSearch = if(
    match(cmdline_lower, "get-childitem|gci |-recurse|dir /s|forfiles|os\.walk|glob\.glob|scandir"),
    1, 0
  )
// Detect sensitive file extension targeting
| eval SensitiveExt = if(
    match(cmdline_lower, "\\.docx?|\\.xlsx?|\\.pdf|\\.pptx?|\\.pst|\\.ost|\\.mdb|\\.accdb|\\.kdbx|\\.pfx|\\.pem|\\.p12|\\.key|\\.csv"),
    1, 0
  )
// Detect archive tools
| eval ArchiveTool = if(
    match(proc_lower, "rar\\.exe|winrar\\.exe|7z\\.exe"),
    1, 0
  )
// Detect mass copy operations with recursive flags
| eval MassCopy = if(
    match(proc_lower, "robocopy\\.exe|xcopy\\.exe")
    and match(cmdline_lower, "/s|/e|/mir"),
    1, 0
  )
// Detect script interpreters used for traversal
| eval ScriptInterpreter = if(
    match(proc_lower, "powershell\\.exe|pwsh\\.exe|python[23]?\\.exe|wscript\\.exe|cscript\\.exe"),
    1, 0
  )
// Detect credential-adjacent files
| eval CredentialFiles = if(
    match(cmdline_lower, "\\.pfx|\\.pem|\\.p12|\\.key|\\.kdbx"),
    1, 0
  )
// Composite risk scoring
| eval SuspicionScore = RecursiveSearch + SensitiveExt + ArchiveTool + MassCopy + CredentialFiles
// Apply detection filter
| where (ScriptInterpreter = 1 and RecursiveSearch = 1 and SensitiveExt = 1)
    or MassCopy = 1
    or (ArchiveTool = 1 and SensitiveExt = 1)
    or SuspicionScore >= 2
| table timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine,
         RecursiveSearch, SensitiveExt, ArchiveTool, MassCopy, CredentialFiles, SuspicionScore
| sort(field=SuspicionScore, order=desc)
| sort(field=timestamp, order=desc)

CrowdStrike LogScale (CQL) detection for automated data collection (T1119) using Falcon ProcessRollup2 events. Applies a suspicion scoring model across recursive file enumeration (PowerShell, CMD, Python), mass copy operations (robocopy, xcopy), document archiving (RAR, 7-Zip), and WScript/CScript FileSystemObject file collection patterns targeting sensitive document and credential file types.

high severity high confidence

Data Sources

CrowdStrike Falcon EDR Falcon ProcessRollup2 events CrowdStrike Falcon Data Replicator (FDR)

Required Tables

#event_simpleName = ProcessRollup2

False Positives

Falcon sensor-enrolled backup agents (e.g., CrashPlan, Cohesity) that launch robocopy or PowerShell Get-ChildItem to enumerate and stage document backups on a recurring schedule
Security operations tooling such as endpoint forensic collectors or incident response scripts that use Python os.walk or glob to gather evidence files by extension
Application packaging teams using 7z.exe or WinRAR to bundle document collections for software releases or internal distribution

Sigma rule & cross-platform mapping

The detection logic for Automated Collection (T1119) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1119 Sigma rules on detection.fyi

Platform-specific guides for T1119

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-18 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PowerShell Recursive Document Collection to Staging Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', '.docx', '.xlsx', '.pdf'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage for each copied file. PowerShell ScriptBlock Log Event ID 4104 with the full collection script. Security Event ID 4663 (if SACL auditing enabled) for each source document read.
Test 2CMD Recursive File Enumeration with dir /s
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'dir /s /b' and '.docx', '.xlsx', '.pdf'. Sysmon Event ID 11: File creation event for %TEMP%\df00tech-filelist.txt. Security Event ID 4688 (if process creation auditing and command line logging are enabled) with full command line including extension targets.
Test 3forfiles Automated Document Enumeration
Expected signal: Sysmon Event ID 1: Process Create for the shell executing forfiles with CommandLine containing 'forfiles', '/S', and '.docx'. Child cmd.exe process creation events as forfiles spawns a cmd.exe instance per matching file. Sysmon Event ID 11: File creation for %TEMP%\df00tech-forfiles.txt. The child cmd.exe processes with 'echo @PATH' are also logged individually.
Test 47-Zip Archive Collection — Document Staging Pre-Exfiltration
Expected signal: Sysmon Event ID 1: Process Create with Image=7z.exe, CommandLine containing 'a' (add to archive), target paths with '.docx', '.xlsx', '.pdf', '-r' (recursive), and '-p' (password). Sysmon Event ID 11: File creation event for %TEMP%\df00tech-archive.7z. Security Event ID 4663 (if auditing enabled) for each source document file opened by 7z.exe during archiving.

Response Playbook

Triage

Examine the full command line for scope: how many file extensions are targeted, which root directories are being searched (C:\Users vs a specific folder), and where is the output being written? Broad multi-extension searches across all user profiles or entire drives are significantly more suspicious than narrow, role-specific queries against a single folder.
Identify the parent process — was the collection script spawned by a remote access tool (powershell.exe with no console window, unusual parent binary), a scheduled task (taskeng.exe, svchost.exe with Task Scheduler), or an Office document? Legitimate backup agents spawn from known service binaries on predictable schedules, not from interactive desktop sessions.
Check the output destination: is data being staged to a temp directory (%TEMP%, %APPDATA%), a user-created folder with a generic name (e.g., 'export', 'data', 'backup', 'archive'), or directly to a mapped network share or cloud-synced folder (OneDrive, Dropbox path)? Staging to temp directories is a characteristic pre-exfiltration pattern.
Verify the user account context — would this user normally run file enumeration or mass copy commands? A standard user account running Get-ChildItem recursively targeting PST files is anomalous; a backup service account running robocopy on a file server is expected. Check if there is a corresponding change ticket or scheduled maintenance window.
Timeline correlation: check for preceding T1083 (File and Directory Discovery) or T1082 (System Information Discovery) events in the 30 minutes prior, and follow-on T1560 (Archive Collected Data) or T1041/T1048 (Exfiltration) activity within the same session. The full kill chain context determines severity.
Check for concurrent network activity from the same process or host — any outbound connections to external IPs, cloud storage domains (mega.nz, anonfiles, gofile.io, or personal Dropbox/Google Drive paths), or unusual ports immediately following the collection indicate active exfiltration in progress.

Containment

If active collection is in progress and exfiltration is suspected: immediately isolate the endpoint using EDR network isolation or emergency VLAN reassignment to halt potential data transfer before it completes — data loss prevention takes priority over evidence preservation at this stage
Identify and preserve the staging directory before any cleanup — do NOT delete it before forensic imaging; the collected file set reveals attacker intent, targeting priorities, and data sensitivity scope. Hash all staged files and document their source paths.
If a remote access tool is orchestrating the collection: terminate the RAT process and kill the associated C2 network connection while simultaneously initiating a memory dump — the process memory may contain C2 configuration, decryption keys, or operator commands
Block outbound connections from the affected host to external storage services (cloud sync paths, file sharing sites, FTP servers) at the perimeter firewall or web proxy layer using the destination IPs/domains identified in network connection logs
If a compromised service account is being used for collection: immediately rotate the account credentials and revoke all active sessions; audit all access events for that account over the preceding 30 days to determine what was accessed before detection
Preserve full disk image and memory dump before any remediation — automated collection leaves MFT journal entries, prefetch artifacts, and staging directory contents that will be overwritten during standard cleanup procedures

Evidence Collection

Sysmon Event ID 1 (Process Create) — full command line, parent process name and command line, user context, process GUID, and file hash of the collection script or tool binary
Sysmon Event ID 11 (File Create) — files written to staging directories; compare file creation timestamps against source file modification dates to establish collection window and identify targeting criteria
Sysmon Event ID 3 (Network Connection) — any outbound connections from the collection process or associated archive tool to external IPs or cloud storage infrastructure, indicating active exfiltration
Windows Security Event ID 4663 (Object Access: File Read/Execute) — if file system object access auditing is enabled via SACL on sensitive directories, records which files were opened; critical for determining data breach scope
PowerShell ScriptBlock Logging (Event ID 4104) — captures full deobfuscated collection script content including any embedded file paths, extension lists, or staging destinations if PowerShell was used
MFT ($MFT) and USN Journal ($UsnJrnl:$J) — records all file system activity including reads and copies within the collection window; parse with MFTECmd or Velociraptor's ntfs artifact to enumerate accessed files even if staging directory was deleted
Prefetch files — C:\Windows\Prefetch\<TOOL>.EXE-*.pf for robocopy, xcopy, rar, 7z — records precise execution timestamps and files referenced during execution; parse with PECmd
Staging directory contents — capture and cryptographically hash all files in the staging area before remediation to document what data was targeted and confirm data sensitivity
Scheduled task export — if collection was automated via scheduled task: schtasks /query /fo XML /v > tasks_export.xml — preserves full task definition including action, trigger, and run-as account
Network proxy and firewall logs — query for outbound POST requests and large response transfers to cloud storage domains, file transfer services, or anomalous external IPs in the 1-hour window following the detected collection activity

Escalation Criteria

! Collection specifically targeting credential files (.pfx, .pem, .kdbx, .p12, .key) alongside document files — combination indicates credential theft intent beyond standard data theft and warrants immediate incident response escalation
! Staging directory found with large volume of sensitive documents (>50MB or >100 files) already prepared and ready for transfer — represents imminent exfiltration risk requiring emergency containment
! Collection script spawned by a known C2 tool indicator (powershell.exe launched from an unusual parent binary with no console window, or immediately following phishing attachment execution or browser exploitation) — indicates active intrusion, not insider threat
! Concurrent or immediately subsequent archive tool (RAR/7z with password flag) usage on the staged files — the combination of T1119 + T1560.001 with password-protected archiving indicates sophisticated operator preparing for exfiltration while preventing recovery
! Collection occurring under a privileged service account, domain admin, or directly on a high-value server (domain controller, file server, SharePoint server, Exchange server, or backup infrastructure) — blast radius and data sensitivity are substantially higher
! Same automated collection pattern detected across multiple endpoints within a short time window (3+ hosts in 30 minutes) — indicates lateral movement has already occurred and a coordinated, automated collection campaign is underway across the environment

Investigation Guide

Forensic Artifacts

> File System: Staging directory contents (typically %TEMP%\<name>, %APPDATA%\<name>, or a user-created folder on the desktop or root of C:) — hash and preserve all contents before remediation; file timestamps reveal collection window
> File System: $MFT entries showing bulk file reads within a short time window — parseable with MFTECmd (Eric Zimmermann tools) or Velociraptor artifact Windows.NTFS.MFT to enumerate accessed files
> File System: $UsnJrnl:$J USN change journal — records file creation, modification, rename, and deletion events in high fidelity; use fsutil usn readjournal or MFTECmd /j to parse
> File System: C:\Windows\Prefetch\ROBOCOPY.EXE-*.pf, RAR.EXE-*.pf, 7Z.EXE-*.pf, POWERSHELL.EXE-*.pf — execution timestamps and file paths referenced during execution (parse with PECmd)
> Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs — recently accessed document paths grouped by extension, revealing file types the user (or attacker) browsed
> Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog commands used to launch collection tools interactively
> Event Log: Security Event ID 4663 (Audit Object Access: File System) — requires SACL configuration on monitored directories; records file open/read events with process PID and user SID
> Event Log: Security Event ID 4698 (Scheduled Task Created) — if collection was scheduled, records task name, trigger, action, and creating user
> Event Log: Microsoft-Windows-PowerShell/Operational Event ID 4104 — full script block content for PowerShell collection scripts including deobfuscated content
> Shell Bags: HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU — records folders browsed via Windows Explorer during manual reconnaissance preceding scripted collection
> LNK files: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent — recently accessed document paths with full source UNC paths (revealing network share sources)

Tuning Guidance

The primary source of false positives for this detection is legitimate backup and enterprise file management software. Start by running the detection with a 7-day lookback and grouping results by AccountName + InitiatingProcessFileName + DeviceName to identify recurring patterns from known tools. Build exclusions based on specific service account + parent process combinations (e.g., VEEAM backup service account spawning robocopy.exe, or Acronis agent spawning cmd.exe with specific path patterns) rather than broad process-level exclusions. For robocopy and xcopy false positives: exclude based on known backup server source hostnames or specific source-destination path combinations documented in your backup policy, not the tool name globally. For PowerShell collection: IT teams legitimately use Get-ChildItem in automation — exclude based on script file hash or specific parent processes (SCCM/Intune management agents: ccmexec.exe, svchost.exe with SCCM service name). Elevate severity unconditionally when collection targets credential files (.pfx, .pem, .kdbx) alongside documents — this combination is absent from legitimate backup workflows. For the volume-based file access hunting query, tune the 20-file threshold upward (50-100) in environments with aggressive backup tooling; tune downward (10) in environments where user endpoints have minimal scripting activity. For cloud hunting, establish a baseline count of normal mailbox export and Azure AD enumeration operations per user per hour, then alert on deviations above 2 standard deviations from the mean rather than a fixed threshold of 5 or 10.

Hunting Queries

Hunt for scripting processes accessing high volumes of sensitive document types within 15-minute windows. This targets the file-creation side (staging) rather than the process launch side, catching collection tools that may not match command-line patterns. Legitimate backup processes show consistent, scheduled patterns from known service accounts; malicious collection shows anomalous spikes from interactive sessions. Threshold of 20+ file operations from a single script in 15 minutes warrants investigation — tune based on your environment's backup tooling.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe")
| where FileName endswith ".docx" or FileName endswith ".xlsx" or FileName endswith ".pdf"
    or FileName endswith ".pst" or FileName endswith ".csv" or FileName endswith ".kdbx"
    or FileName endswith ".pfx" or FileName endswith ".pem"
| summarize FilesAccessed=count(),
           UniqueExtensions=dcount(tostring(split(FileName, ".")[-1])),
           UniqueDirectories=dcount(FolderPath),
           SampleFiles=make_set(FileName, 5)
  by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 15m)
| where FilesAccessed >= 20
| sort by FilesAccessed desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe"
   OR Image="*\\python*.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
  (TargetFilename="*.docx" OR TargetFilename="*.xlsx" OR TargetFilename="*.pdf"
   OR TargetFilename="*.pst" OR TargetFilename="*.csv" OR TargetFilename="*.kdbx" OR TargetFilename="*.pfx")
| bin _time span=15m
| stats count as FilesCreated, dc(TargetFilename) as UniqueFiles, values(TargetFilename) as SampleFiles
  by _time, host, User, Image, CommandLine
| where FilesCreated >= 10
| sort - FilesCreated

Hunt for collection scripts launched via Scheduled Tasks. Adversaries use scheduled tasks for persistent, recurring collection — Gamaredon Group deploys document-scanning scripts on timed intervals across compromised systems. This pattern differs from the main detection by specifically targeting the task scheduler parent relationship (schtasks.exe, taskeng.exe, taskhostw.exe), identifying collection that survives reboots and runs repeatedly without user interaction. Any collection script running from a scheduled task that was not provisioned through change management warrants investigation.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "schtasks.exe"
    or InitiatingProcessCommandLine has "schtasks"
    or InitiatingProcessFileName =~ "taskeng.exe"
    or InitiatingProcessFileName =~ "taskhostw.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "python.exe", "python3.exe")
| where ProcessCommandLine has_any ("-Recurse", "Get-ChildItem", "dir /s", "forfiles", "robocopy", "xcopy",
                                     "os.walk", "glob.glob", "GetFolder", "CopyFile")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\schtasks.exe" OR ParentImage="*\\taskeng.exe" OR ParentImage="*\\taskhostw.exe")
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe"
   OR Image="*\\wscript.exe" OR Image="*\\python*.exe")
  (CommandLine="*-Recurse*" OR CommandLine="*Get-ChildItem*" OR CommandLine="*dir /s*"
   OR CommandLine="*forfiles*" OR CommandLine="*robocopy*" OR CommandLine="*os.walk*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for cloud-based automated collection patterns in Azure AD audit logs and Office 365 activity. ROADTools-style Azure AD enumeration (bulk Get-AzureADUser calls), bulk mailbox export requests, and high-volume Exchange item aggregation are the cloud variants of T1119 — used by UNC3944 and similar threat actors who leverage cloud APIs for automated data gathering after OAuth token theft. This query targets the cloud collection vector distinct from endpoint-based file enumeration. Spikes in mailbox export or bulk AD user enumeration from a single UPN in a short window warrant investigation into the source application and whether it is authorized.

Hunting — KQL

kql

AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any (
    "New-MailboxExportRequest", "Get-MailboxExportRequest",
    "Search-Mailbox", "Add-MailboxPermission",
    "Get-MsolUser", "Get-AzureADUser", "Get-AzureADGroup",
    "SearchExported", "ExchangeItemAggregated"
)
| extend UPN = tostring(InitiatedBy.user.userPrincipalName)
| extend AppId = tostring(InitiatedBy.app.appId)
| summarize Count=count(),
           Operations=make_set(OperationName),
           TargetObjects=make_set(tostring(TargetResources), 10)
  by UPN, AppId, bin(TimeGenerated, 1h)
| where Count > 5
| sort by Count desc

Hunting — SPL

spl

index=o365 sourcetype="o365:management:activity"
  (Operation="New-MailboxExportRequest" OR Operation="Search-Mailbox"
   OR Operation="Get-MsolUser" OR Operation="Get-AzureADUser"
   OR Operation="SearchExported" OR Operation="ExchangeItemAggregated"
   OR Operation="Add-MailboxPermission")
| bin _time span=1h
| stats count as Count, dc(ObjectId) as UniqueObjects, values(Operation) as Operations
  by _time, UserId, ClientIP, UserAgent
| where Count > 10
| sort - Count

Atomic Red Team Tests

Test 1 PowerShell Recursive Document Collection to Staging Directory

windows

Simulates adversary automated collection using PowerShell Get-ChildItem with recursive file enumeration targeting common document extensions (.docx, .xlsx, .pdf). The script copies matching files to a staging directory in %TEMP%, replicating behavior observed in Gamaredon Group intrusions and RedCurl campaigns that stage collected documents before exfiltration. Limits to 20 files to prevent excessive test impact.

Command

powershell

powershell.exe -Command "$stage = Join-Path $env:TEMP 'df00tech-stage'; New-Item -ItemType Directory -Force -Path $stage | Out-Null; Get-ChildItem -Path $env:USERPROFILE -Recurse -Include *.docx,*.xlsx,*.pdf -ErrorAction SilentlyContinue | Select-Object -First 20 | ForEach-Object { Copy-Item $_.FullName -Destination $stage -ErrorAction SilentlyContinue }; Write-Output ('Staged: ' + (Get-ChildItem $stage).Count + ' files to ' + $stage)"

Cleanup

powershell

powershell.exe -Command "Remove-Item -Recurse -Force (Join-Path $env:TEMP 'df00tech-stage') -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', '.docx', '.xlsx', '.pdf'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage for each copied file. PowerShell ScriptBlock Log Event ID 4104 with the full collection script. Security Event ID 4663 (if SACL auditing enabled) for each source document read.

Expected Detection

KQL alert fires: FileName=powershell.exe, AutoColl_RecursiveSearch=true, AutoColl_SensitiveExt=true. SPL alert fires: ScriptInterpreter=1, RecursiveSearch=1, SensitiveExt=1, SuspicionScore >= 2. File access hunting query fires if 20 files are staged within the 15-minute window.

Test 2 CMD Recursive File Enumeration with dir /s

windows

Uses the Windows built-in 'dir' command with /s (recursive) and /b (bare format) flags to enumerate document files across the user profile, outputting an inventory to a temp file. Replicates the batch script collection technique observed in APT1 and RedCurl campaigns, where a file inventory list precedes targeted exfiltration of high-value documents.

Command

powershell

cmd.exe /c "dir /s /b %USERPROFILE%\*.docx %USERPROFILE%\*.xlsx %USERPROFILE%\*.pdf %USERPROFILE%\*.pptx > %TEMP%\df00tech-filelist.txt 2>&1"

Cleanup

powershell

cmd.exe /c "del /f /q %TEMP%\df00tech-filelist.txt 2>nul"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'dir /s /b' and '.docx', '.xlsx', '.pdf'. Sysmon Event ID 11: File creation event for %TEMP%\df00tech-filelist.txt. Security Event ID 4688 (if process creation auditing and command line logging are enabled) with full command line including extension targets.

Expected Detection

KQL alert fires: FileName=cmd.exe, ProcessCommandLine contains 'dir' and '/s' and extension patterns, AutoColl_RecursiveSearch=true, AutoColl_SensitiveExt=true. SPL alert fires: RecursiveSearch=1, SensitiveExt=1, SuspicionScore >= 2.

Test 3 forfiles Automated Document Enumeration

windows

Uses the forfiles LOLBin to recursively process files matching a document extension pattern, writing file paths and sizes to a staging list. forfiles supports date-based filtering (-d flag) which threat actors use to collect recently modified documents since a specific date. This test enumerates .docx files in the Documents folder without copying them, generating the process creation telemetry at lower noise than full copy.

Command

powershell

forfiles /P "%USERPROFILE%\Documents" /S /M *.docx /C "cmd /c echo @PATH @FSIZE" > "%TEMP%\df00tech-forfiles.txt" 2>&1

Cleanup

powershell

cmd.exe /c "del /f /q "%TEMP%\df00tech-forfiles.txt" 2>nul"

Expected Telemetry

Sysmon Event ID 1: Process Create for the shell executing forfiles with CommandLine containing 'forfiles', '/S', and '.docx'. Child cmd.exe process creation events as forfiles spawns a cmd.exe instance per matching file. Sysmon Event ID 11: File creation for %TEMP%\df00tech-forfiles.txt. The child cmd.exe processes with 'echo @PATH' are also logged individually.

Expected Detection

KQL alert fires: ProcessCommandLine has 'forfiles' and '.docx'. SPL alert fires: RecursiveSearch=1 (forfiles match), SensitiveExt=1, SuspicionScore >= 2.

Test 4 7-Zip Archive Collection — Document Staging Pre-Exfiltration

windows

Creates a 7-Zip archive of documents from the user's Documents folder using recursive flag, simulating the pre-exfiltration staging behavior of Micropsia malware (which uses RAR with similar extension lists) and numerous APT groups. The archive step represents the T1119 to T1560.001 transition observed in real intrusions. Uses a password flag (-p) as adversaries typically password-protect archives to prevent recovery and evade content inspection.

Command

powershell

7z.exe a "%TEMP%\df00tech-archive.7z" "%USERPROFILE%\Documents\*.docx" "%USERPROFILE%\Documents\*.xlsx" "%USERPROFILE%\Documents\*.pdf" -r -pTESTpassword123

Cleanup

powershell

cmd.exe /c "del /f /q "%TEMP%\df00tech-archive.7z" 2>nul"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=7z.exe, CommandLine containing 'a' (add to archive), target paths with '.docx', '.xlsx', '.pdf', '-r' (recursive), and '-p' (password). Sysmon Event ID 11: File creation event for %TEMP%\df00tech-archive.7z. Security Event ID 4663 (if auditing enabled) for each source document file opened by 7z.exe during archiving.

Expected Detection

KQL alert fires: FileName=7z.exe, AutoColl_ArchiveTool=true, AutoColl_SensitiveExt=true. SPL alert fires: ArchiveTool=1, SensitiveExt=1, SuspicionScore >= 2. Note: 7z.exe must be installed at a location in PATH for this test to execute; the Command line pattern is still useful for detection tuning even if 7z is absent from the test system.

What is T1119 Automated Collection?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1119

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox