1. Home
  2. ATT&CK Techniques
  3. T1213 Data from Information Repositories

T1213 Data from Information Repositories

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

  • Policies, procedures, and standards
  • Physical / logical network diagrams
  • System architecture diagrams
  • Technical system documentation
  • Testing / development credentials (i.e., Unsecured Credentials)
  • Work / project schedules
  • Source code snippets
  • Links to network shares and other internal resources
  • Contact or other sensitive information about business partners and customers, including personally identifiable information (PII)

Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following:

  • Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases
  • Collaboration platforms such as SharePoint, Confluence, and code repositories
  • Messaging platforms such as Slack and Microsoft Teams

In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relational Database Service (RDS), Redis, or ElasticSearch.(Citation: Mitiga)(Citation: TrendMicro Exposed Redis 2020)(Citation: Cybernews Reuters Leak 2022)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.PS-01.01 Configuration baselines Mitigates T1213 Data from Information Repositories
Comments
This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
References
    PR.PS-01.02 Least functionality Mitigates T1213 Data from Information Repositories
    Comments
    This diagnostic statement provides for limiting unnecessary software, services, ports, protocols, etc. Ensuring systems only have installed and enabled what is essential for their operation reduces the attack surface and minimizes vulnerabilities, which mitigates a wide range of techniques.
    References
      PR.AA-05.02 Privileged system access Mitigates T1213 Data from Information Repositories
      Comments
      This diagnostic statement protects against Data from Information Repositories through the use of privileged account management and the use of multi-factor authentication.
      References
        PR.AA-04.01 Access control within and across security perimeters Mitigates T1213 Data from Information Repositories
        Comments
        This diagnostic statement provides protection from Data from Information Repositories through the implementation of privileged account management controls to limit credential access. Employing limitations to specific accounts, access control mechanisms, and auditing the attribution logs provides protection against adversaries attempting to access sensitive data in information repositories.
        References
          PR.DS-01.01 Data-at-rest protection Mitigates T1213 Data from Information Repositories
          Comments
          This diagnostic statement focuses on protecting data-at-rest by implementing encryption and other security measures such as sandboxing, authentication, segregation, masking, tokenization, and file integrity monitoring.
          References
            PR.DS-10.01 Data-in-use protection Mitigates T1213 Data from Information Repositories
            Comments
            This Diagnostic Statement describes mitigations related to protecting data-in-use, mentioning encryption, access control methods and authentication. Using encryption for data-in-use, alongside other safeguards such for restricting exfiltration of sensitive data aid with mitigating collection and exfiltration threats.
            References
              PR.PS-01.06 Encryption management practices Mitigates T1213 Data from Information Repositories
              Comments
              This diagnostic statement is associated with employing encryption methods to mitigate unauthorized access or theft of data that protect the confidentiality and integrity of data-at-rest, data-in-use, and data-in-transit. To address threats to data from information repositories, encrypt data stored at rest in databases.
              References
                PR.PS-01.03 Configuration deviation Mitigates T1213 Data from Information Repositories
                Comments
                This diagnostic statement provides protection from Data from Information Repositories through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baseline configurations that include data retention policies to periodically archive and/or delete data and integrity checking can help protect against adversaries attempting to leverage information repositories.
                References
                  PR.PS-01.07 Cryptographic keys and certificates Mitigates T1213 Data from Information Repositories
                  Comments
                  This diagnostic statement protects against Code Repositories through the use of revocation of keys and key management. Employing key protection strategies such as removing keys from information repositories, limitations to specific accounts along with access control mechanisms provides protection against adversaries attempting to glean credentials from code repositories.
                  References
                    PR.PS-01.09 Virtualized end point protection Mitigates T1213 Data from Information Repositories
                    Comments
                    The diagnostic statement outlines several mechanisms that organizations can use to protect endpoint systems with virtualization technologies, focusing primarily on hypervisor hardening. By implementing hypervisor hardening measures—such as requiring multi-factor authentication to restrict access to resources and information stored in the cloud from various virtual machines, organizations may help prevent data leakage caused by adversaries exploiting VM instances.
                    References
                      PR.AA-01.02 Physical and logical access Mitigates T1213 Data from Information Repositories
                      Comments
                      This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts.
                      References
                        PR.AA-03.01 Authentication requirements Mitigates T1213 Data from Information Repositories
                        Comments
                        This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials.
                        References
                          PR.AA-01.01 Identity and credential management Mitigates T1213 Data from Information Repositories
                          Comments
                          This diagnostic statement protects against Data from Information Repositories through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                          References
                            PR.PS-01.05 Encryption standards Mitigates T1213 Data from Information Repositories
                            Comments
                            This diagnostic statement is associated with employing strong encryption methods to mitigate unauthorized access or theft of data that protect the confidentiality and integrity of data-at-rest, data-in-use, and data-in-transit. To address threats to data from information repositories, encrypt data stored at rest in databases.
                            References

                              NIST 800-53 Mappings

                              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                              CA-07 Continuous Monitoring mitigates T1213 Data from Information Repositories
                              CM-06 Configuration Settings mitigates T1213 Data from Information Repositories
                              CM-05 Access Restrictions for Change mitigates T1213 Data from Information Repositories
                              AC-17 Remote Access mitigates T1213 Data from Information Repositories
                              IA-08 Identification and Authentication (Non-Organizational Users) mitigates T1213 Data from Information Repositories
                              AC-21 Information Sharing mitigates T1213 Data from Information Repositories
                              SC-37 Out-of-band Channels mitigates T1213 Data from Information Repositories
                              AC-23 Data Mining Protection mitigates T1213 Data from Information Repositories
                              IA-04 Identifier Management mitigates T1213 Data from Information Repositories
                              SC-28 Protection of Information at Rest mitigates T1213 Data from Information Repositories
                              RA-05 Vulnerability Monitoring and Scanning mitigates T1213 Data from Information Repositories
                              CM-08 System Component Inventory mitigates T1213 Data from Information Repositories
                              SI-07 Software, Firmware, and Information Integrity mitigates T1213 Data from Information Repositories
                              AC-16 Security and Privacy Attributes mitigates T1213 Data from Information Repositories
                              CM-02 Baseline Configuration mitigates T1213 Data from Information Repositories
                              CM-02 Baseline Configuration mitigates T1213 Data from Information Repositories
                              IA-02 Identification and Authentication (Organizational Users) mitigates T1213 Data from Information Repositories
                              CM-07 Least Functionality mitigates T1213 Data from Information Repositories
                              SI-04 System Monitoring mitigates T1213 Data from Information Repositories
                              AC-02 Account Management mitigates T1213 Data from Information Repositories
                              AC-03 Access Enforcement mitigates T1213 Data from Information Repositories
                              AC-04 Information Flow Enforcement mitigates T1213 Data from Information Repositories
                              AC-05 Separation of Duties mitigates T1213 Data from Information Repositories
                              AC-06 Least Privilege mitigates T1213 Data from Information Repositories
                              CM-03 Configuration Change Control mitigates T1213 Data from Information Repositories

                              VERIS Mappings

                              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                              action.malware.variety.Capture stored data Capture data stored on system disk related-to T1213 Data from Information Repositories
                              attribute.confidentiality.data_disclosure None related-to T1213 Data from Information Repositories

                              Azure Mappings

                              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                              advanced_threat_protection_for_azure_sql_database Advanced Threat Protection for Azure SQL Database technique_scores T1213 Data from Information Repositories
                              Comments
                              This control may alert on extraction of a large amount of data to an unusual location. No documentation is provided on the logic for determining an unusual location.
                              References
                              1. https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview
                              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse
                              alerts_for_azure_cosmos_db Alerts for Azure Cosmos DB technique_scores T1213 Data from Information Repositories
                              Comments
                              This control triggers an alert when an unusually large amount of data is extracted from/by an account compared to recent activity. False positives are fairly likely and extraction in quantities below the control's threshold is not detected, so score is Minimal. Neither of the sub-techniques are relevant in this context, since they are repository-specific. Relevant alert is "Unusual amount of data extracted from a Cosmos DB account"
                              References
                              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference
                              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/other-threat-protections
                              3. https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/defender-for-cosmos-db
                              defender_for_open_source_databases Microsoft Defender for Open-Source Relational Databases technique_scores T1213 Data from Information Repositories
                              Comments
                              This control can detect suspicious login activity.
                              References
                              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-open-source-relational-databases

                              GCP Mappings

                              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                              cloud_identity Cloud Identity technique_scores T1213 Data from Information Repositories
                              Comments
                              MFA and enforcing the principal of least privilege can be used to control adversaries and possibly hinder them from gaining access to a victim network or a private code repository.
                              References
                              1. ['https://cloud.google.com/identity']

                              ATT&CK Subtechniques

                              Technique ID Technique Name Number of Mappings
                              T1213.002 Sharepoint 29
                              T1213.001 Confluence 29
                              T1213.004 Customer Relationship Management Software 27
                              T1213.003 Code Repositories 23
                              T1213.005 Messaging Applications 29