atomic-red-team/Windows/Collection/Automated_Collection.md

Automated Collection

MITRE ATT&CK Technique: T1119

cmd.exe

find:

Input:

 dir c: /b /s .docx | findstr /e .docx

copy:

Input:

for /R c: %f in (*.docx) do copy %f c:\temp\

PowerShell

Find and copy

Input:

powershell Get-ChildItem -Recurse -Include *.doc | % {Copy-Item $_.FullName -destination c:\temp}