APT28G0007 ↗
Has collected files from various information repositories.1
tfMITRE ATT&CK technique
Data from Information Repositories T1213
- Tactic
- Collection
- Platforms
- Linux, Windows, macOS, SaaS, IaaS, Office Suite
- Version
- 3.4
- Created
- 18 April 2018
- Last modified
- 24 October 2025
- Contributors
- Regina Elwell; Praetorian; Milos Stojadinovic; Isif Ibrahima, Mandiant; Obsidian Security; Naveen Vijayaraghavan; Nilesh Dherange (Gurucul)
Sub-techniques 613 rules across the family · 7 mapped directly to T1213 · 2 of 6 carry rules
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.7
Detection rules69th pct
Detection rules69th percentile · 69% of ATT&CK techniques have this many detection rules written or fewer.Data from Information Repositories MITRE reference T1213
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.1
All 1 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Troll StealerS1196 ↗
Gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.12
Raccoon StealerS1148 ↗
Gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.1
All 2 software entries for this technique
Offense vs defense T1213
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 0
first rule: 2024 Q1 · 1 of 1 campaigns plottedData from Information Repositories detection strategy DET0413
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Abuse of Information Repositories for Data Collection
4 platforms
AN1160 · Windows
Programmatic or excessive access to file shares, SharePoint, or database repositories by users not typically interacting with them. This includes abnormal access by privileged accounts, enumeration of large numbers of files, or downloads of sensitive content in bursts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage AccessDC0025 | m365:unified | Accessed SharePoint files or pages |
| Network Share AccessDC0102 | WinEventLog:Security | EventCode=5145 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Privileged users may be excluded if they routinely perform admin actions on SharePoint or file shares. |
| AccessVolumeThreshold | The number of files accessed or pages retrieved in a short window to flag as abnormal. |
| TimeWindow | The time range (e.g., 5 minutes, 1 hour) in which burst access patterns are considered anomalous. |
AN1161 · Linux
Command-line tools (e.g., curl, rsync, wget, or custom Python scripts) used to scrape documentation systems or internal REST APIs. Unusual access patterns to knowledge base folders or shared team drives.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | auditd:SYSCALL | execve of curl, rsync, wget with internal knowledge base or IPs |
| Network Connection CreationDC0082 | linux:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandRegex | Regex matching internal doc servers, knowledge base paths, or IP patterns. |
| TimeWindow | Burst access of repositories over a short time window. |
AN1162 · SaaS
Abuse of SaaS platforms such as Confluence, GitHub, SharePoint Online, or Slack to access excessive internal documentation or export source code/data. Includes use of tokens or browser automation from unapproved IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:confluence | access.content |
| Cloud Service ModificationDC0069 | saas:slack | Exported file or accessed admin API |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| APIUsageThreshold | Number of API calls or files accessed before triggering detection. |
| KnownSafeIPs | Whitelist of internal IPs/users that may be excluded from detection. |
AN1163 · macOS
Access of mounted cloud shares or document repositories via browser, terminal, or Finder by users not typically interacting with those resources. Includes script-based enumeration or mass download.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | curl, python scripts, rsync with internal share URLs |
| File AccessDC0055 | macos:unifiedlog | access to /Volumes/SharePoint or network mount |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccessedMountPath | Paths to sensitive volumes may differ based on org setup. |
| UserGroup | Expected user groups that typically access shared data. |
AuditM1047
Consider periodic review of accounts and privileges for critical and sensitive repositories. Ensure that repositories such as cloud-hosted databases are not unintentionally exposed to the public, and that security groups assigned to them permit only necessary and authorized hosts.
Encrypt data stored at rest in databases.
Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
Create plans for leveraging a secure out-of-band communications channel, rather than existing in-network chat applications, in case of a security incident.
Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
User TrainingM1017
Develop and publish policies that define acceptable information to be stored in repositories.