Detect Data from Information Repositories in Elastic Security
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion. Targets include SharePoint, Confluence, code repositories, CRM systems, databases, and messaging platforms such as Slack and Microsoft Teams. Adversaries may harvest credentials, network diagrams, system architecture documentation, PII, or source code from these repositories. Cloud-native services (AWS RDS, ElasticSearch, Redis) may also be improperly secured, enabling unauthenticated access to sensitive data stores.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1213 Data from Information Repositories
- Canonical reference
- https://attack.mitre.org/techniques/T1213/
Elastic Detection Query
sequence by user.name with maxspan=1h
[any where event.dataset == "o365.audit" and event.provider == "SharePoint" and event.action in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed", "FilePreviewed") ] with runs=50
// Branch 2: Sensitive keyword searches
// Run separately:
// any where event.dataset == "o365.audit" and event.provider == "SharePoint" and event.action == "SearchQueryPerformed" and
// wildcard(o365.audit.SearchQuery, "*password*", "*credential*", "*secret*", "*vpn*", "*api key*", "*private key*", "*connection string*", "*network diagram*", "*architecture*", "*payroll*", "*salary*")
// Branch 3: Bulk external sharing
// any where event.dataset == "o365.audit" and event.provider in ("SharePoint", "OneDrive") and
// event.action in ("SharingInvitationCreated", "AnonymousLinkCreated", "SecureLinkCreated") ] with runs=5Detects data mining from Microsoft 365 information repositories including bulk file access from SharePoint/OneDrive exceeding 50 operations per hour, sensitive keyword searches (passwords, credentials, API keys, network diagrams), and bulk external document sharing. Covers MITRE ATT&CK T1213 - adversaries harvesting credentials, architecture documentation, PII, and source code from collaboration platforms.
Data Sources
Required Tables
False Positives & Tuning
- Authorized IT administrators performing bulk migrations or backups of SharePoint/OneDrive content during documented maintenance windows
- Security or compliance teams conducting authorized eDiscovery or data audits searching for sensitive keywords across the tenant
- Automated sync clients or third-party backup tools (Veeam, Avepoint) performing scheduled full synchronization of document libraries
Other platforms for T1213
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk SharePoint Document Download via PnP PowerShell
Expected signal: OfficeActivity events: Operation=FileDownloaded for each downloaded file, Workload=SharePoint, UserId=authenticated user UPN, ClientIP=executing machine IP. Azure AD SigninLogs: interactive authentication event for the SharePoint OAuth flow. Sysmon Event ID 1: Process Create for powershell.exe with PnP module loading.
- Test 2SharePoint Sensitive Keyword Search via REST API
Expected signal: OfficeActivity events: Operation=SearchQueryPerformed for each API search call, with SearchQuery field containing the sensitive keyword, Workload=SharePoint, UserId=authenticated user. Multiple events in quick succession for each term searched.
- Test 3Confluence REST API Page Enumeration and Export
Expected signal: Confluence access logs (atlassian-confluence.log): GET requests to /wiki/rest/api/space and /wiki/rest/api/search endpoints with user authentication. If Confluence audit logging is enabled: search events appear in Administration > Audit Log. Network proxy logs: HTTP requests to the Confluence FQDN with search query parameters visible in URL.
- Test 4Microsoft Teams Message Export via Graph API
Expected signal: OfficeActivity events: Operation=MessageRead or similar Teams audit events, Workload=MicrosoftTeams. Azure AD SigninLogs: token acquisition for Graph API with Teams scopes. AuditLogs: Microsoft Graph API calls for Team and ChannelMessage read operations. Microsoft Defender for Cloud Apps: Graph API activity anomaly if CASB is configured.
References (10)
- https://attack.mitre.org/techniques/T1213/
- https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance
- https://learn.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide
- https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2
- https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html
- https://learn.microsoft.com/en-us/graph/teams-list-all-teams
- https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots
- https://www.trendmicro.com/en_us/research/20/d/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1213/T1213.md
- https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps
Unlock Pro Content
Get the full detection package for T1213 including response playbook, investigation guide, and atomic red team tests.