Data from Information Repositories
Technique · ATTACK:enterprise:T1213
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1213",
"title": "Data from Information Repositories",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1213",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d28ef391-8ed4-45dc-bc4a-2f43abf54416",
"external_id": "T1213",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2025-10-24T17:49:26.262Z",
"version": "3.4",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Mitiga",
"url": "https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots"
},
{
"source_name": "Atlassian Confluence Logging",
"url": "https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html"
},
{
"source_name": "TrendMicro Exposed Redis 2020",
"url": "https://www.trendmicro.com/en_us/research/20/d/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html"
},
{
"source_name": "Microsoft SharePoint Logging",
"url": "https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2"
},
{
"source_name": "Sharepoint Sharing Events",
"url": "https://docs.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide#sharepoint-sharing-events"
},
{
"source_name": "Cybernews Reuters Leak 2022",
"url": "https://cybernews.com/security/thomson-reuters-leaked-terabytes-sensitive-data/"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bd8bb5f-6210-4460-84c4-b7fab86e08a2
ATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e1fb9b9-c5b9-42ca-9a46-afb7b03be48c
TrustedSec OOB CommunicationsATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ffde834-36f9-463d-93c4-77048f020cf9
ATTACK:enterprise:T1213.003 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b060a1c-932f-4864-a5a4-83f324b62338
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5377ce7e-ae13-4902-a7f9-98e83d04808b
CrowdStrike StellarParticle January 2022ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--617db1e2-ad66-46b2-8dfc-02094a861754
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63cb5def-6905-45b0-9f14-9958eb39758e
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:T1213.006 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--642980fc-444a-42f8-b602-276114bfae07
ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77cf946d-eb39-4f49-abd0-a64733ea9538
Sekoia Raccoon2 2022ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d1f1a6a-f2ab-4ee9-9c06-6afeac5d033b
S2W Troll Stealer 2024 · Symantec Troll Stealer 2024ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--874ce66b-4b7a-4396-bbd5-d125f2bbeecb
AI-Mexico-Govt-Breach · AI-Mexico-Govt-CompromiseATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b3f2915-ca04-4770-88bb-e6f1314da34d
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d07ed87-6692-4010-8c94-c12cbf3885ca
Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:T1213.005 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ccb448d-955e-438a-b394-bdafa50092b7
ATTACK:enterprise:T1213.004 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8a181e0-74b8-42e2-96c7-a75e57cbb2fe
ATTACK:enterprise:T1213.002 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b37b128a-aefc-4b40-9d2a-c213d7b29b43
ATTACK:enterprise:T1213.001 → subtechnique-of → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de195a33-8461-4d6a-aa6a-cb2893904c66
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eacf09ab-0264-4af8-bfa5-f3be9df47e3f
AWS DB VPCATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1213
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6d679df-1b24-4f80-a50e-96ee86b881e9