T1213.006sub-technique of T1213 Data from Information Repositories
Databases
IaaS · Linux · macOS · SaaS · Windowsnothing on this site yetT1213.006 on attack.mitre.org
Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Suspicious Database Access and Dump Activity Across Environments (T1213.006)
- Unusual database command-line access (e.g., `psql`, `mysql`, `mongo`) from non-admin users, occurring outside typical automation windows or without known service context. Often followed by data dumps to.sql/.csv files or outbound data transfers.
- Database client execution (e.g., sqlcmd.exe, isql.exe) by users or from locations not tied to enterprise automation or backups. Often followed by creation of.sql/.bak/.csv files, registry artifacts for ODBC/JDBC drivers, or encrypted ZIPs.
- Execution of Java-based or CLI database tools (e.g., DBeaver, Beekeeper, mysql, psql) from user profiles not tied to dev/admin roles, especially when followed by file writes and cloud sync activity.
- Database enumeration and export activity (e.g., `SELECT * FROM`, `SHOW DATABASES`) issued via ephemeral VMs, admin APIs, or cloud shell from non-monitoring accounts.
what reduces it
- M1017 User Training. Develop and publish policies that define acceptable information to be stored in databases and acceptable handling of customer data. Only store information required for business operations.
- M1018 User Account Management. Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
- M1054 Software Configuration. Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
- M1047 Audit. Consider periodic review of accounts and privileges for critical and sensitive databases.
- M1041 Encrypt Sensitive Information. Encrypt data stored at rest in databases.