ShinyHuntersG1057 ↗
Has collected Salesforce datasets from victims in the airline and retail sectors.1
tfMITRE ATT&CK sub-technique
Databases T1213.006
sub-technique of T1213 Data from Information Repositories
- Tactic
- Collection
- Platforms
- IaaS, Linux, macOS, SaaS, Windows
- Version
- 1.0
- Created
- 22 May 2025
- Last modified
- 12 May 2026
Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Databases MITRE reference T1213.006
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Sea TurtleG1041 ↗
Used the tool Adminer to remotely logon to the MySQL service of victim machines.1
FIN6G0037 ↗
Has collected schemas and user accounts from systems running SQL Server.1
Sandworm TeamG0034 ↗
Exfiltrates data of interest from enterprise databases using Adminer.1
TurlaG0010 ↗
Has used a custom .NET tool to collect documents from an organization's internal central database.1
All 5 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Anthropic AI-orchestrated CampaignC0062 ↗
During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal databases and systems to extract proprietary information, system configurations, and sensitive operational data. 1
APT41 DUSTC0040 ↗
Collected data from victim Oracle databases using SQLULDR2.1
Leviathan Australian IntrusionsC0049 ↗
Leviathan gathered information from SQL servers and Building Management System (BMS) servers during Leviathan Australian Intrusions.1
All 3 campaigns for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.1
GlassWormS9010 ↗
Has collected data from macOS devices through the gathering of Apple Notes related files by targeting /Library/Group Containers/group.com.apple.notes/NoteStore.sqlite, /Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal, and /Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm.1
MgBotS1146 ↗
Includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.1
P.A.S. WebshellS0598 ↗
Has the ability to list and extract data from SQL databases.1
All 4 software entries for this technique
Offense vs defense T1213.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Databases detection strategy DET0242
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Suspicious Database Access and Dump Activity Across Environments (T1213.006)
5 platforms
AN0676 · Linux
Unusual database command-line access (e.g., psql, mysql, mongo) from non-admin users, occurring outside typical automation windows or without known service context. Often followed by data dumps to .sql/.csv files or outbound data transfers. Defender sees CLI tools launched interactively or by unusual parent processes, file writes to dump-like filenames, and external connections shortly after.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of CLI tools like psql, mysql, mongo, sqlite3 |
| File CreationDC0039 | auditd:PATH | Creation of files with extensions .sql, .csv, .sqlite, especially in user directories |
| Network Traffic ContentDC0085 | NSM:Flow | http::post: Outbound HTTP POST from host shortly after DB export activity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedDBClients | List of user or automation accounts expected to use database clients |
| DumpFilePattern | Filename patterns used to identify data dumps (e.g., *.sql, backup_*.csv) |
| TimeWindow | Time threshold for correlating execution, file write, and outbound transfer |
AN0677 · Windows
Database client execution (e.g., sqlcmd.exe, isql.exe) by users or from locations not tied to enterprise automation or backups. Often followed by creation of .sql/.bak/.csv files, registry artifacts for ODBC/JDBC drivers, or encrypted ZIPs. Defender sees SQL tools launched by explorer.exe, Powershell, or odd parent processes, plus file writes in user temp locations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| KnownDBToolPaths | Directories where legitimate database tools are installed |
| ExportExtensionPatterns | List of file extensions commonly used for DB exports |
| MaxTransferVolume | Threshold for outbound data volume that may suggest large DB dumps |
AN0678 · macOS
Execution of Java-based or CLI database tools (e.g., DBeaver, Beekeeper, mysql, psql) from user profiles not tied to dev/admin roles, especially when followed by file writes and cloud sync activity. Defender correlates GUI tool launches, file write events in ~/Downloads or ~/Documents, and outbound API calls to known cloud services.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Process start of Java or native DB client tools |
| File CreationDC0039 | macos:unifiedlog | Writes of .sql/.csv/.xlsx files to user documents/downloads |
| Network Traffic ContentDC0085 | NSM:Flow | HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CloudSyncDomainList | FQDNs of sync services used to detect likely outbound DB leakages |
| UserPrivilegeLevel | Whether to treat low-privilege users accessing DB tools as higher risk |
AN0679 · IaaS
Database enumeration and export activity (e.g., SELECT * FROM, SHOW DATABASES) issued via ephemeral VMs, admin APIs, or cloud shell from non-monitoring accounts. Defender correlates audit logs (CloudTrail, GCP Admin, AzureDiagnostics), storage write ops, and cross-region transfers by identities not tied to DB operations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage AccessDC0025 | AWS:CloudTrail | PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access |
| Cloud Service MetadataDC0070 | AWS:CloudTrail | rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context |
| Network Connection CreationDC0082 | AWS:VPCFlowLogs | Large transfer volume (>20MB) from RDS IP range to external public IPs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IAMAccessPatterns | Define which IAM roles/accounts are allowed DB operations |
| S3ExportThreshold | Size threshold (MB) or file pattern for S3-based exfil monitoring |
| DBQueryVerbosityThreshold | Number of rows/columns or duration to flag long-running queries |
AN0680 · SaaS
Unusual or excessive database/table exports from SaaS database platforms (e.g., Snowflake, Firebase, BigQuery, Airtable) by users or apps not in known analytics or dev groups. Defender observes access patterns outside baseline working hours or with new query templates, and correlates those with audit logs or file downloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:Snowflake | QUERY: Large or repeated SELECT * queries to sensitive tables |
| File AccessDC0055 | m365:unified | Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BaselineQueryTemplates | Query hash or shape for common BI/ETL jobs to reduce false positives |
| OffHoursAccessWindow | Window to define after-hours activity thresholds for DB access |
AuditM1047
Consider periodic review of accounts and privileges for critical and sensitive databases.
Encrypt data stored at rest in databases.
Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed.
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
User TrainingM1017
Develop and publish policies that define acceptable information to be stored in databases and acceptable handling of customer data. Only store information required for business operations.