Databases
Subtechnique · ATTACK:enterprise:T1213.006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1213.006",
"title": "Databases",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1213/006",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--248d3fe1-7fe1-4d71-91c7-8bb7ef35cad3",
"external_id": "T1213.006",
"domain": "enterprise",
"created": "2025-05-22T19:02:46.718Z",
"modified": "2026-05-12T15:12:00.623Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Google Cloud Threat Intelligence UNC5537 Snowflake 2024",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04d9eeb2-158d-49d4-a100-555f6cf341ea
Socket GlassWorm January 2026ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--106a3217-411d-4927-9023-b14750dc3fc3
Aqua Security Blog Trivy Compromise APR 2026ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--177a712f-3f52-49b6-8cf3-981991fd5e69
CISA Leviathan 2024ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ba96cb7-3417-4091-af1f-c27d8e350ea1
Leonard TAG 2023ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e7796f2-6b52-4bf1-9a5c-b6e19d50791c
Google Cloud APT41 2024ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21d98f1d-9d9f-446d-9437-ead5a148bff7
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23749a96-a086-4e14-b6c1-44bc9c7d99c1
Visa FIN6 Feb 2019ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24f93862-49f9-4222-a9c1-d230239462bf
ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3db3aaaf-a736-4110-8fd4-51c6cc80a34b
ESET EvasivePanda 2023ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6095f810-6d06-435f-9a16-a643bf8055df
ATTACK:enterprise:T1213.006 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--642980fc-444a-42f8-b602-276114bfae07
ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9679784f-2ae7-4ce4-9bb6-ba24a84d5906
AI-Mexico-Govt-BreachATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4a622e8-be15-4592-8383-8f5d72861ad5
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b197d556-bb6b-499b-9c0b-98e2d946edf9
Hunt Sea Turtle 2024ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3e2abaa-f431-4791-95d0-d44f3a74a73f
ESET ComRAT May 2020ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7a46041-8eb6-4756-b633-f5bf89310f50
ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cba11c5f-afe2-42e1-8995-8b1105d75e7a
ANSSI Sandworm January 2021ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0d35cd6-3fdb-476e-b830-214f32c2d104
ElecticIQ Buyukkaya_ShinyHunters_Sept2025ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3755e68-451c-4be8-8886-9aecb52cfb56
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1213.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7b16a14-f75d-48ae-bd3d-a64983e67581