GCP bigquery.jobs.insert
Submits a BigQuery query, load, extract, or copy job.
Collection
Collection
Section titled “Collection”The adversary is trying to gather data of interest to their goal.
Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary’s objectives. Frequently, the next goal after collecting data is to either steal (exfiltrate) the data or to use the data to gain more information about the target environment. Common target sources include various drive types, browsers, audio, video, and email. Common collection methods include capturing screenshots and keyboard input.
In cloud environments, adversaries collect data from storage services (S3, Blob Storage, GCS), databases, and snapshots. They may create copies of EBS volumes or database snapshots, query data warehouses, or access logging buckets that contain sensitive operational data.
View Collection on MITRE ATT&CK →Events Related to Collection
Section titled “Events Related to Collection”Explore this tactic in the map.
GCP cloudsql.instances.export
Requests a Cloud SQL export to Cloud Storage.
Azure CopyBlob
Requests a server-side copy of an Azure blob.
AWS CopyObject
Copies an S3 object to another key or bucket.
AWS CreateDBSnapshot
Starts creation of a manual RDS DB instance snapshot.
AWS CreateImage
Starts creation of an EBS-backed AMI from an EC2 instance.
AWS CreateInstanceExportTask
Starts an eligible EC2 instance export to an S3 bucket.
AWS CreateSnapshot
Starts creation of a point-in-time EBS volume snapshot.
AWS DeleteBucketPolicy
Removes an S3 bucket policy without resetting other access controls.
AWS GetObject
Retrieves an S3 object or selected version, optionally as a byte range.
Azure Microsoft.Compute/disks/beginGetAccess/action
Requests temporary access to an Azure managed disk.
Azure Microsoft.Compute/snapshots/beginGetAccess/action
Requests temporary access to an Azure managed-disk snapshot.
Azure Microsoft.Sql/servers/databases/export/action
Requests export of Azure SQL Database schema and data to a BACPAC in Blob Storage.
AWS PutBucketAcl
Replaces an S3 bucket ACL where ACLs are enabled.
AWS PutBucketPublicAccessBlock
Sets the four bucket-level S3 Block Public Access controls.
AWS RestoreDBInstanceFromDBSnapshot
Creates a new RDS DB instance from a snapshot.
AWS StartExportTask
Starts an RDS data export to Amazon S3.