TA0009

Collection Detection Rules

The adversary is trying to gather data of interest to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.

df00tech ships 63 production-ready detection rules mapped to the Collection tactic (TA0009). Each rule below includes copy-paste queries for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar, Sumo Logic, Chronicle and LogScale, with data-source requirements, severity and false-positive guidance — free to use.

Unlock the full Pro package

Response playbooks, investigation guides and atomic tests for every technique — from £29/mo.

Upgrade to Pro

Collection detections (63)

Related tactics

Defense Evasion (TA0005)

266 detections

Persistence (TA0003)

225 detections

Initial Access (TA0001)

222 detections

All MITRE ATT&CK Tactics

TA0043 Reconnaissance TA0042 Resource Development TA0001 Initial Access TA0002 Execution TA0003 Persistence TA0004 Privilege Escalation TA0005 Defense Evasion TA0006 Credential Access TA0007 Discovery TA0008 Lateral Movement TA0009 Collection TA0011 Command and Control TA0010 Exfiltration TA0040 Impact