ShinyHuntersG1057 ↗
Has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.1
tfMITRE ATT&CK sub-technique
Code Repositories T1213.003
sub-technique of T1213 Data from Information Repositories
- Tactic
- Collection
- Platform
- SaaS
- Version
- 1.2
- Created
- 11 May 2021
- Last modified
- 12 May 2026
- Contributors
- Itamar Mizrahi, Cymptom; Toby Kohlenberg; Josh Liburdi, @jshlbrd
Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Code Repositories MITRE reference T1213.003
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Scattered SpiderG1015 ↗
Enumerates data stored within victim code repositories, such as internal GitHub repositories.12
LAPSUS$G1004 ↗
Has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.12
APT41G0096 ↗
Cloned victim user Git repositories during intrusions.1
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 downloaded source code from code repositories.1
All 1 campaigns for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has gathered and downloaded data stored on both compromised and publicly accessible code repositories.1
TeamPCP Cloud StealerS9041 ↗
Can target sensitive file paths in Git repos to extract credentials.12
GlassWormS9010 ↗
Has gathered code repository authentication materials for NPM and GitHub.123 GlassWorm has collected details pertaining to the npm configuration data for _authToken.23
TruffleHogS9009 ↗
Has gathered data and credentials from code repositories.1
Shai-HuludS9008 ↗
Has downloaded existing packages from code repositories and extracted data stored within them.1
All 5 software entries for this technique
Offense vs defense T1213.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 0
first rule: 2023 Q1 · 1 of 1 campaigns plottedCode Repositories detection strategy DET0263
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms
1 platform
AN0732 · SaaS
Anomalous or bulk download activity from private or restricted repositories by non-developer or privileged accounts, often preceded by unusual login behavior (e.g., unfamiliar geo, OAuth token use, elevated API rate).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:github | Bulk access to multiple files or large volume of repo requests within short time window |
| Logon Session CreationDC0067 | saas:github | Login from unusual IP, device fingerprint, or location; access token creation from new client |
| Cloud Service MetadataDC0070 | saas:github | repo.download, repo.clone, oauth.authorize, repo.getContent |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Threshold for file access volume over short duration (e.g., 10+ repos accessed in <5 min) |
| UserContext | Role or permission profile expected to interact with repositories (e.g., developers vs. admins) |
| GeoAnomalyThreshold | Distance or variance allowed before a login is flagged as anomalous |
| RepoSensitivityTag | Whether a repository is labeled sensitive or restricted |
AuditM1047
Consider periodic reviews of accounts and privileges for critical and sensitive code repositories. Scan code repositories for exposed credentials or other sensitive information.
Use multi-factor authentication for logons to code repositories.
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization for code repositories.
User TrainingM1017
Develop and publish policies that define acceptable information to be stored in code repositories.