- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1074.001 Local Data Staging
- T1114.002 Remote Email Collection
- T1213 Data from Information Repositories
- T1560.001 Archive via Utility
- T1025 Data from Removable Media (index only)
- T1056 Input Capture (index only)
- T1056.001 Keylogging (index only)
- T1056.002 GUI Input Capture (index only)
- T1056.003 Web Portal Capture (index only)
- T1056.004 Credential API Hooking (index only)
- T1074 Data Staged (index only)
- T1074.002 Remote Data Staging (index only)
- T1113 Screen Capture (index only)
- T1114 Email Collection (index only)
- T1114.001 Local Email Collection (index only)
- T1114.003 Email Forwarding Rule (index only)
- T1115 Clipboard Data (index only)
- T1119 Automated Collection (index only)
- T1123 Audio Capture (index only)
- T1125 Video Capture (index only)
- T1185 Browser Session Hijacking (index only)
- T1213.001 Confluence (index only)
- T1213.002 Sharepoint (index only)
- T1213.003 Code Repositories (index only)
- T1213.004 Customer Relationship Management Software (index only)
- T1213.005 Messaging Applications (index only)
- T1213.006 Databases (index only)
- T1530 Data from Cloud Storage (index only)
- T1557 Adversary-in-the-Middle (index only)
- T1557.001 Name Resolution Poisoning and SMB Relay (index only)
- T1557.002 ARP Cache Poisoning (index only)
- T1557.003 DHCP Spoofing (index only)
- T1557.004 Evil Twin (index only)
- T1560 Archive Collected Data (index only)
- T1560.002 Archive via Library (index only)
- T1560.003 Archive via Custom Method (index only)
- T1602 Data from Configuration Repository (index only)
- T1602.001 SNMP (MIB Dump) (index only)
- T1602.002 Network Device Configuration Dump (index only)