tfMITRE ATT&CK sub-technique

Confluence T1213.001

sub-technique of T1213 Data from Information Repositories

Tactic: Collection
Platform: SaaS
Version: 1.1
Created: 14 February 2020
Last modified: 12 May 2026

Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Confluence MITRE reference T1213.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

LAPSUS$G1004 ↗

Has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.1

created 2022-06-091 referenceaka DEV-0537

All 1 groups for this technique

Offense vs defense T1213.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Confluence detection strategy DET0358

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Programmatic and Excessive Access to Confluence Documentation

Enterprise

1 platform

AN1019 · SaaS

Detection of excessive or programmatic access to Confluence spaces or pages, particularly by privileged users, through a combination of access logs, API usage, and identity context. Correlates logon sessions, user roles, and abnormal document viewing or export behavior. Identifies burst access patterns and tools/scripts abusing the Confluence API for mass enumeration or data scraping.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:confluence	access.content
Logon Session CreationDC0067	saas:confluence	logon
Network Traffic ContentDC0085	saas:confluence	REST API access from non-browser agents

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines the time span (e.g., 5m, 1h) in which excessive access behavior becomes suspicious.
UserContext	Privileged user roles (e.g., domain admins) should be excluded or flagged if found accessing documentation repositories.
AccessThreshold	The number of pages viewed or exported by a single user before triggering detection logic.
AgentFilter	User agent strings that may indicate scripted, automated, or non-interactive access methods.

Confluence detections T1213.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs