Collection (MITRE Tactic).

The MITRE ATT&CK tactic (TA0009) covering techniques used to gather information of interest before it is exfiltrated. It belongs to the Defense & Operations category of cybersecurity.

The MITRE ATT&CK tactic (TA0009) covering techniques used to gather information of interest before it is exfiltrated.

Collection (MITRE ATT&CK tactic TA0009) groups techniques attackers use to identify and stage data of value before exfiltration. Common techniques include screen capture, keylogging, clipboard monitoring, audio and video capture, archiving files from local and network drives, mailbox harvesting in Microsoft 365 or Google Workspace, automated collection scripts, and accessing cloud storage buckets. Adversaries typically compress and encrypt the data into staging archives (.zip, .rar, .7z) in temp directories to keep network throughput low and to bypass DLP signatures. Defenders detect Collection through DLP rules, mailbox-audit logs, anomalous file-access patterns, large local archive creation, EDR detections on screen-capture and keylogger APIs, and honey files that fire alerts when read.

Defences for Collection (MITRE Tactic) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Data staging, TA0009.