Use automated methods, such as scripts, for collecting data (Automated Collection [T1119]) - Capture user input to obtain credentials and collect information (Input Capture [T1056]) - Collect local systems data from a compromised system (Data from Local System [T1005]) - Take screen captures of the desktop (Screen Capture [T1113]) - Collect data stored in the Windows clipboard from users (Clipboard Data [T1115