T1213.003sub-technique of T1213 Data from Information Repositories
Code Repositories
SaaSnothing on this site yetT1213.003 on attack.mitre.org
Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms
- Anomalous or bulk download activity from private or restricted repositories by non-developer or privileged accounts, often preceded by unusual login behavior (e.g., unfamiliar geo, OAuth token use, elevated API rate).
what reduces it
- M1017 User Training. Develop and publish policies that define acceptable information to be stored in code repositories.
- M1018 User Account Management. Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization for code repositories.
- M1032 Multi-factor Authentication. Use multi-factor authentication for logons to code repositories.
- M1047 Audit. Consider periodic reviews of accounts and privileges for critical and sensitive code repositories. Scan code repositories for exposed credentials or other sensitive information.