tfMITRE ATT&CK sub-technique

Code Repositories T1593.003

sub-technique of T1593 Search Open Websites/Domains

Tactic: Reconnaissance
Platform: PRE
Version: 1.0
Created: 09 August 2022
Last modified: 12 May 2026
Contributors: Matt Burrough, @mattburrough, Microsoft; Vinayak Wadhwa, SAFE Security

Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Code Repositories MITRE reference T1593.003

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has searched through target companies’ GitHub repositories for login credentials or API keys.1

created 2026-07-291 referenceaka UNC6240

Contagious InterviewG1052 ↗

Had identified and solicited victims through code repositories such as GitHub.1

created 2025-10-191 referenceaka DeceptiveDevelopment

LAPSUS$G1004 ↗

Has searched public code repositories for exposed credentials.1

created 2022-06-091 referenceaka DEV-0537

HAFNIUMG0125 ↗

Has discovered leaked corporate credentials on public repositories including GitHub.1

created 2021-03-031 referenceaka Operation Exchange Marauder

All 4 groups for this technique

Offense vs defense T1593.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2023 Q1

Code Repositories detection strategy DET0805

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Code Repositories

Enterprise

1 platform

AN1937 · PRE

Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

Code Repositories detections T1593.003

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs