Sharepoint
Subtechnique · ATTACK:enterprise:T1213.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1213.002",
"title": "Sharepoint",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1213/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0c4b4fda-9062-47da-98b9-ceae2dcf052a",
"external_id": "T1213.002",
"domain": "enterprise",
"created": "2020-02-14T13:35:32.938Z",
"modified": "2026-10-07T17:43:08.237Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Information architecture guidance for SharePoint Online portals",
"url": "https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/portal-information-architecture"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06ee5784-6390-42ac-990a-0f90558ade30
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e472133-290f-42f3-9dd3-104b7ba978d2
Secureworks GOLD SAHARAATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24f5e8ad-02e9-43d5-9f82-cd9cc1b7a7b6
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--370fb415-02d5-416c-bb69-d629600dc14b
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69e06021-a60c-49ac-840a-47ae154dbba8
ATTACK:enterprise:S0227 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a0748a1-7629-4afb-b089-ae068608a964
NCC Group APT15 Alive and StrongATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7080d506-ac77-4519-93aa-92bc490a2756
NCC Group Chimera January 2021ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--714ba6ae-8c53-4ce1-81f4-4ca81bbdb9b7
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--743ed7c3-c0e3-4290-9410-f6bec9224c30
RSAC 2015 Abu Dhabi Stefano MaccagliaATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b2f6151-c019-4910-91a7-9dd6744c4ffb
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81fa7012-ab0a-4c16-b729-c390f3cf8eb9
DOJ FBI Handala Hack March 2026ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9725630d-a737-43dd-a68f-a09987735846
NCC Group APT15 Alive and StrongATTACK:enterprise:T1213.002 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b37b128a-aefc-4b40-9d2a-c213d7b29b43
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8e05047-85f2-4c28-8918-12d6874a45c2
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edb23250-7787-45ba-97ad-2b2f34923f2d
Mandiant_UNC1549TTPsTools_Nov2025