# What is collection in MITRE ATT&CK?

Collection is the attacker gathering the data they want before taking it out: copying files from shares into one place, compressing them into archives, reading mailboxes, exporting a database, taking screenshots. It often shows up as one host suddenly reading far more from file servers or databases than it ever has, sometimes at night, followed by a pause while the archives are built. File and database audit logs show what was read, and endpoint tools see archives being created. On the network, the gathering looks like new sessions from that host to many file servers, and the next step, exfiltration, like unusual outbound volume from it. Limit who can read what, especially service accounts with broad file access. NetSenX flags new host-to-host sessions and unusual outbound data volume per host on every plan; it does not see which files were read inside encrypted sessions.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-collection-in-mitre-attack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is command and control (C2) as an ATT&CK tactic?](https://netsenx.com/en/faq/what-is-command-and-control-in-mitre-attack)
- [What is the Impact tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-impact-tactic-in-mitre-attack)
- [What is the cyber kill chain, and how does it relate to MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-cyber-kill-chain)
- [How can a small team use MITRE ATT&CK to find gaps in its detection?](https://netsenx.com/en/faq/how-to-use-mitre-attack-to-find-gaps-in-detection)
- [What happens after an attacker gets into the network?](https://netsenx.com/en/faq/what-happens-after-an-attacker-gets-in)