T1213
Data from Information Repositories
Linux · Windows · macOS · SaaS · IaaS · Office Suite2 pieces on this siteT1213 on attack.mitre.org
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Insider threat response plan: evidence, proportion and the employee who may have done nothing
The response where the usual instincts are wrong. Speed matters less than lawfulness, the suspect is a colleague with rights, and half of these turn out to be misunderstanding. A plan for investigating quietly, preserving what you would need, and being able to stand behind how you did it.
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Abuse of Information Repositories for Data Collection
- Programmatic or excessive access to file shares, SharePoint, or database repositories by users not typically interacting with them. This includes abnormal access by privileged accounts, enumeration of large numbers of files, or downloads of sensitive content in bursts.
- Command-line tools (e.g., curl, rsync, wget, or custom Python scripts) used to scrape documentation systems or internal REST APIs. Unusual access patterns to knowledge base folders or shared team drives.
- Abuse of SaaS platforms such as Confluence, GitHub, SharePoint Online, or Slack to access excessive internal documentation or export source code/data. Includes use of tokens or browser automation from unapproved IPs.
- Access of mounted cloud shares or document repositories via browser, terminal, or Finder by users not typically interacting with those resources. Includes script-based enumeration or mass download.
what reduces it
- M1017 User Training. Develop and publish policies that define acceptable information to be stored in repositories.
- M1060 Out-of-Band Communications Channel. Create plans for leveraging a secure out-of-band communications channel, rather than existing in-network chat applications, in case of a security incident.
- M1018 User Account Management. Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
- M1032 Multi-factor Authentication. Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
- M1054 Software Configuration. Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
- M1047 Audit. Consider periodic review of accounts and privileges for critical and sensitive repositories. Ensure that repositories such as cloud-hosted databases are not unintentionally exposed to the public, and that security groups assigned to them permit only necessary and authorized hosts.