Data collection is the act of gathering files, logs, configuration files, credentials, or other useful artifacts from a system for later use. In cyber security, it often means an attacker is mapping a host or environment before escalation, persistence, or exfiltration. The collected material can reveal software versions, account names, remote access paths, and operational dependencies.
This stage matters because it can happen quietly and may not trigger obvious damage. Attackers often search local directories, archive files, or copy system logs through scripts or malware. Defenders should watch for unusual file access, new archive creation, suspicious use of admin tools, and outbound connections that follow local collection activity. Preserving endpoint and network logs helps investigators determine whether the activity stayed on the host or became data exfiltration.