T0089 "Obtain Private Documents"

Tactic stage: TA06

Summary: Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be "leaked" during later stages in the operation.

Relationships

Has counters:

Detection methods include:

Datasets

Examples include:

Seen in incidents: