MITRE ATT&CK Enterprise techniques whose primary tactic is Collection: detection with open-source tooling and cyber range exercises.
Detecting T1005 Data from Local System on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, File Creation and File Access. Covers the ATT&CK mitigation Data Loss Prevention and how to rehearse the detection in a cyber range.
Detecting T1025 Data from Removable Media on Linux, macOS and Windows, using telemetry such as Process Creation, File Access and Drive Creation. Covers the ATT&CK mitigation Data Loss Prevention and how to rehearse the detection in a cyber range.
Detecting T1039 Data from Network Shared Drive on Linux, macOS and Windows, using telemetry such as File Creation, File Access and Network Share Access. Covers how to rehearse the detection in a cyber range.
Detecting T1056 Input Capture on Linux, macOS, Network Devices and Windows, using telemetry such as Process Creation, File Access and Network Traffic Content. Covers its 4 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1074 Data Staged on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, File Access and File Creation. Covers its 2 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1113 Screen Capture on Linux, macOS and Windows, using telemetry such as Process Creation and Module Load. Covers how to rehearse the detection in a cyber range.
Detecting T1114 Email Collection on Windows, macOS, Linux and Office Suite, using telemetry such as Process Creation, File Access and Command Execution. Covers its 3 sub-techniques, the ATT&CK mitigations Encrypt Sensitive Information and Audit, and how to rehearse the detection in a cyber range.
Detecting T1115 Clipboard Data on Linux, macOS and Windows, using telemetry such as Process Creation and Process Access. Covers how to rehearse the detection in a cyber range.
Detecting T1119 Automated Collection on IaaS, Linux, macOS and Office Suite and other platforms, using telemetry such as Process Creation, File Access and File Creation. Covers the ATT&CK mitigations Encrypt Sensitive Information and Remote Data Storage and how to rehearse the detection in a cyber range.
Detecting T1123 Audio Capture on Linux, macOS and Windows, using telemetry such as Process Creation, File Access and File Creation. Covers how to rehearse the detection in a cyber range.
Detecting T1125 Video Capture on Linux, macOS and Windows, using telemetry such as Process Creation, File Creation and File Access. Covers how to rehearse the detection in a cyber range.
Detecting T1185 Browser Session Hijacking on Windows, using telemetry such as Network Connection Creation, Process Access and Module Load. Covers the ATT&CK mitigations User Account Management and User Training and how to rehearse the detection in a cyber range.
Detecting T1213 Data from Information Repositories on Linux, Windows, macOS and SaaS and other platforms, using telemetry such as Process Creation, File Access and Command Execution. Covers its 6 sub-techniques, the ATT&CK mitigations Encrypt Sensitive Information and Audit, and how to rehearse the detection in a cyber range.
Detecting T1530 Data from Cloud Storage on IaaS, Office Suite and SaaS, using telemetry such as Network Traffic Content, User Account Authentication and Cloud Storage Access. Covers the ATT&CK mitigations Encrypt Sensitive Information and Audit and how to rehearse the detection in a cyber range.
Detecting T1560 Archive Collected Data on Linux, macOS and Windows, using telemetry such as Process Creation, File Creation and Command Execution. Covers its 3 sub-techniques, the ATT&CK mitigation Audit, and how to rehearse the detection in a cyber range.
Detecting T1602 Data from Configuration Repository on Network Devices, using telemetry such as Network Traffic Content and Network Connection Creation. Covers its 2 sub-techniques, the ATT&CK mitigations Encrypt Sensitive Information and Software Configuration, and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.