ATT&CK Technique · Collection
T1119 Automated CollectionMapped by 3 reports, 8 detection rules and 4 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Detection rules
Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.
Detection rules
Multi-Actor AI-Agent Framework Abuse (8 Operators)ARPA Observability Harvester Systemd Service Pattern (YARA, Detection); Instana API Enumeration via Stolen JWT (ARPA Observability Harvester, Case 2) (SIGMA, Detection)
Detection rules
Turkish ARPA AI-Augmented Observability Compromise (209.38.205.158)Rule 2: ARPA Observability Harvester Platform (YARA, Detection); Rule 4: Multi-Source Observability Polling Python Script (YARA, Detection); Rule 6: ARPA Cross-Source Correlation ETL Engine (YARA, Detection); Sigma Rule 7: Observability Platform Authentication Event (Cross-Source Burst Indicator) (SIGMA, Hunting); Sigma Rule 8: Rapid Instana Topology API Enumeration from Single Source (SIGMA, Hunting)
Detection rules
BellaMain Turkish PhaaS Panel (79.137.192.3)BellaMain USOM Poll, Telegram Bot Outbound, and Correlations (SIGMA, Hunting)
Tracked actors
Designations whose reports map this technique.
- UTA-2026-008: Developer and operator of the BellaMain Turkish phishing-as-a-service panel
- UTA-2026-013: Espionage-flavoured operator harvesting a state-affiliated insurer's observability stack through an AI agent platform
- UTA-2026-018: Hands-on-keyboard operator exploiting four Southeast Asian governments with a bespoke edge-device toolkit
- UTA-2026-019: Grey-market personal-data harvester running scores of LLM-assisted attack scripts against Chinese consumer platforms
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.