Automated Collection is the use of scripts, command-line tools, or custom software to gather files, emails, credentials, logs, or other information at scale before theft. Instead of an operator opening items one by one, the attacker lets automation enumerate directories, copy matching files, compress archives, and stage data for later exfiltration.
This matters because collection is often the point where a breach becomes profitable. Fast, scripted gathering can pull large volumes of sensitive material before defenders notice, and it can help attackers prioritize what to steal first. In real attacks, automated collection may look like bursty file access, repeated searches for keywords or file types, bulk copying from shared drives, or staged archives created just before outbound transfer. Defenders watch for these patterns with endpoint logging, DLP, file-access baselines, and alerts on unusual local or network activity.