VOID MANTICOREG1055 ↗
Has accessed victim’s public facing SharePoint servers and exfiltrated data.1
tfMITRE ATT&CK sub-technique
Sharepoint T1213.002
sub-technique of T1213 Data from Information Repositories
- Tactic
- Collection
- Platforms
- Office Suite, Windows
- Version
- 1.1
- Created
- 14 February 2020
- Last modified
- 12 May 2026
- Contributor
- Arun Seelagan, CISA
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Sharepoint MITRE reference T1213.002
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
AkiraG1024 ↗
Has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.1
LAPSUS$G1004 ↗
Has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.12
HAFNIUMG0125 ↗
Has abused compromised credentials to exfiltrate data from SharePoint.1
ChimeraG0114 ↗
Has collected documents from the victim's SharePoint.1
APT28G0007 ↗
Has collected information from Microsoft SharePoint services within target networks.1
All 7 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
C0027C0027 ↗
During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.1
All 1 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TruffleHogS9009 ↗
Has searched SharePoint for data and credentials.1
spwebmemberS0227 ↗
Is used to enumerate and dump information from Microsoft SharePoint.1
All 2 software entries for this technique
Offense vs defense T1213.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2025 Q1 · 1 of 1 campaigns plottedSharepoint detection strategy DET0500
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users
1 platform
AN1380 · Windows
Privileged or rarely used accounts performing bulk access to SharePoint files or metadata over a short time window, indicating potential scripted collection of sensitive internal documents.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | FileAccessed, FileDownloaded, SearchQueried |
| Logon Session CreationDC0067 | azure:signinlogs | UserLogin, ConditionalAccessPolicyEvaluated |
| Cloud Service MetadataDC0070 | m365:sharepoint | Multiple file download operations on a site by a privileged account in a short time window |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Can be adjusted to focus on specific high-privilege or rarely-used service accounts |
| TimeWindow | Defines the aggregation period for multiple download events (e.g., 10 minutes) |
| DownloadThreshold | Minimum number of documents accessed/downloaded to trigger alert |
| SiteScope | Limit detection to sensitive SharePoint sites such as HR, Finance, Engineering |
AuditM1047
Consider periodic review of accounts and privileges for critical and sensitive SharePoint repositories.
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
User TrainingM1017
Develop and publish policies that define acceptable information to be stored in SharePoint repositories.