T1213.001sub-technique of T1213 Data from Information Repositories
Confluence
SaaSnothing on this site yetT1213.001 on attack.mitre.org
Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing /...
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Programmatic and Excessive Access to Confluence Documentation
- Detection of excessive or programmatic access to Confluence spaces or pages, particularly by privileged users, through a combination of access logs, API usage, and identity context. Correlates logon sessions, user roles, and abnormal document viewing or export behavior.
what reduces it
- M1017 User Training. Develop and publish policies that define acceptable information to be stored in Confluence repositories.
- M1018 User Account Management. Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
- M1047 Audit. Consider periodic review of accounts and privileges for critical and sensitive Confluence repositories.