Detect Data from Information Repositories in CrowdStrike LogScale
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion. Targets include SharePoint, Confluence, code repositories, CRM systems, databases, and messaging platforms such as Slack and Microsoft Teams. Adversaries may harvest credentials, network diagrams, system architecture documentation, PII, or source code from these repositories. Cloud-native services (AWS RDS, ElasticSearch, Redis) may also be improperly secured, enabling unauthenticated access to sensitive data stores.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1213 Data from Information Repositories
- Canonical reference
- https://attack.mitre.org/techniques/T1213/
LogScale Detection Query
// Branch 1: Bulk SharePoint/OneDrive file access via Office 365 activity events
// CrowdStrike ingests O365 audit logs via the Falcon Data Replicator or third-party connector
#event_simpleName=O365AuditEvent
| Workload = /SharePoint|OneDrive/i
| Operation = /FileDownloaded|FileSyncDownloadedFull|FileAccessed|FilePreviewed|FileSyncUploadedFull/i
| groupBy([UserId, timebucket(field=timestamp, bucket="1h")], function=[
count(as=OperationCount),
count(ObjectId, distinct=true, as=UniqueFiles),
collect([Operation], limit=10, as=Operations),
collect([ClientIP], limit=10, as=SourceIPs),
collect([SiteUrl], limit=5, as=SiteUrls)
])
| OperationCount >= 50
| RiskLevel := if(OperationCount >= 500, "Critical",
if(OperationCount >= 200, "High",
if(OperationCount >= 50, "Medium", "Low")))
| DetectionBranch := "BulkFileAccess"
| sort(OperationCount, order=desc)
| select([timebucket, UserId, OperationCount, UniqueFiles, Operations, SourceIPs, SiteUrls, RiskLevel, DetectionBranch])
// Branch 2: Sensitive keyword searches — run as separate saved query:
// #event_simpleName=O365AuditEvent
// | Workload = /SharePoint/i
// | Operation = "SearchQueryPerformed"
// | SearchQuery = /password|credential|secret|vpn|api.key|private.key|connection.string|network.diagram|architecture|payroll|salary/i
// | groupBy([UserId], function=[
// count(as=SearchCount),
// count(SearchQuery, distinct=true, as=UniqueQueries),
// collect([SearchQuery], limit=5, as=QuerySamples),
// collect([ClientIP], limit=5, as=SourceIPs)
// ])
// | SearchCount >= 3
// | DetectionBranch := "SensitiveKeywordSearch"
// | select([UserId, SearchCount, UniqueQueries, QuerySamples, SourceIPs, DetectionBranch])CrowdStrike LogScale (Falcon) query detecting data mining from SharePoint and OneDrive information repositories using Office 365 audit events ingested via Falcon Data Replicator or equivalent connector. Identifies bulk file access patterns (50+ ops/hr) with risk tiering and a companion query for sensitive keyword searches targeting credentials, architecture docs, and PII. Maps to MITRE ATT&CK T1213.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise content management workflows where automated service accounts sync SharePoint libraries to on-premises DMS platforms, generating sustained high-volume file access events during business hours
- IT helpdesk or support staff remotely accessing user OneDrive to assist with file recovery or permissions troubleshooting, particularly when scoped to large personal document libraries
- Legal hold or compliance export tools performing bulk document collection from SharePoint for litigation support or regulatory audit requests, appearing identical to adversarial bulk downloads
Other platforms for T1213
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk SharePoint Document Download via PnP PowerShell
Expected signal: OfficeActivity events: Operation=FileDownloaded for each downloaded file, Workload=SharePoint, UserId=authenticated user UPN, ClientIP=executing machine IP. Azure AD SigninLogs: interactive authentication event for the SharePoint OAuth flow. Sysmon Event ID 1: Process Create for powershell.exe with PnP module loading.
- Test 2SharePoint Sensitive Keyword Search via REST API
Expected signal: OfficeActivity events: Operation=SearchQueryPerformed for each API search call, with SearchQuery field containing the sensitive keyword, Workload=SharePoint, UserId=authenticated user. Multiple events in quick succession for each term searched.
- Test 3Confluence REST API Page Enumeration and Export
Expected signal: Confluence access logs (atlassian-confluence.log): GET requests to /wiki/rest/api/space and /wiki/rest/api/search endpoints with user authentication. If Confluence audit logging is enabled: search events appear in Administration > Audit Log. Network proxy logs: HTTP requests to the Confluence FQDN with search query parameters visible in URL.
- Test 4Microsoft Teams Message Export via Graph API
Expected signal: OfficeActivity events: Operation=MessageRead or similar Teams audit events, Workload=MicrosoftTeams. Azure AD SigninLogs: token acquisition for Graph API with Teams scopes. AuditLogs: Microsoft Graph API calls for Team and ChannelMessage read operations. Microsoft Defender for Cloud Apps: Graph API activity anomaly if CASB is configured.
References (10)
- https://attack.mitre.org/techniques/T1213/
- https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance
- https://learn.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide
- https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2
- https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html
- https://learn.microsoft.com/en-us/graph/teams-list-all-teams
- https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots
- https://www.trendmicro.com/en_us/research/20/d/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1213/T1213.md
- https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps
Unlock Pro Content
Get the full detection package for T1213 including response playbook, investigation guide, and atomic red team tests.