T1213 Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Bitbucket Unauthorized Full Data Export Triggeredcriticaltest · bitbucket
- Bitbucket Full Data Export Triggeredhightest · bitbucket
- OpenCanary - GIT Clone Requesthightest · opencanary
- OpenCanary - MSSQL Login Attempt Via SQLAuthhightest · opencanary
- OpenCanary - MSSQL Login Attempt Via Windows Authenticationhightest · opencanary
- OpenCanary - MySQL Login Attempthightest · opencanary
- OpenCanary - REDIS Action Command Attempthightest · opencanary
- Bitbucket User Details Export Attempt Detectedmediumtest · bitbucket
- Bitbucket User Permissions Export Attemptmediumtest · bitbucket
- Github Delete Action Invokedmediumtest · github
- Github Outside Collaborator Detectedmediumtest · github
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.