Which SIEM platforms have a T1213 detection rule?

df00tech provides T1213 (Data from Information Repositories) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Data from Information Repositories (T1213)?

Detecting Data from Information Repositories requires the following data sources: Application Log: Application Log Content, Cloud Service: Cloud Service Enumeration, Microsoft 365 Unified Audit Log, SharePoint Audit Logs, OneDrive Audit Logs.

What severity and confidence is the T1213 detection?

The T1213 detection is rated high severity with medium confidence.

What are common false positives for T1213?

Common false positives for T1213 include: Migration projects — IT teams or contractors using tools like ShareGate or AvePoint to migrate SharePoint content generate extremely high file access counts; Backup and archival solutions — tools like Veeam, AvePoint Backup, or native SharePoint backup solutions download all files regularly; Legitimate enterprise search indexing — search crawlers or content indexing services authorized by IT generate bulk FileAccessed events.

T1213 IBM QRadar · QRadar

Detect Data from Information Repositories in IBM QRadar

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion. Targets include SharePoint, Confluence, code repositories, CRM systems, databases, and messaging platforms such as Slack and Microsoft Teams. Adversaries may harvest credentials, network diagrams, system architecture documentation, PII, or source code from these repositories. Cloud-native services (AWS RDS, ElasticSearch, Redis) may also be improperly secured, enabling unauthenticated access to sensitive data stores.

MITRE ATT&CK

Tactic: Collection
Technique: T1213 Data from Information Repositories
Canonical reference: https://attack.mitre.org/techniques/T1213/

QRadar Detection Query

IBM QRadar (QRadar)

sql

-- Branch 1: Bulk file access from SharePoint/OneDrive
SELECT
  USERNAME AS UserId,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm') AS EventWindow,
  COUNT(*) AS OperationCount,
  COUNT(DISTINCT "URL") AS UniqueFiles,
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS CategoryName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  ARRAY_AGG(DISTINCT sourceip) AS SourceIPs,
  CASE
    WHEN COUNT(*) >= 500 THEN 'Critical'
    WHEN COUNT(*) >= 200 THEN 'High'
    WHEN COUNT(*) >= 50 THEN 'Medium'
    ELSE 'Low'
  END AS RiskLevel
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND LOWER("Application") IN ('sharepoint', 'onedrive')
  AND LOWER("Operation") IN ('filedownloaded', 'filesyncdownloadedfull', 'fileaccessed', 'filepreviewed', 'filesyncuploadedfull')
  AND starttime > (CURRENT_TIMESTAMP - 86400000)
GROUP BY
  USERNAME,
  TRUNCATE(starttime, 3600000)
HAVING COUNT(*) >= 50
ORDER BY OperationCount DESC

-- Branch 2: Sensitive keyword searches (run as separate query)
-- SELECT USERNAME, COUNT(*) AS SearchCount, ARRAY_AGG(DISTINCT "SearchQuery") AS Queries, ARRAY_AGG(DISTINCT sourceip) AS SourceIPs
-- FROM events
-- WHERE LOGSOURCETYPEID = 397 AND LOWER("Application") = 'sharepoint' AND LOWER("Operation") = 'searchqueryperformed'
-- AND (LOWER("SearchQuery") LIKE '%password%' OR LOWER("SearchQuery") LIKE '%credential%' OR LOWER("SearchQuery") LIKE '%vpn%'
--   OR LOWER("SearchQuery") LIKE '%api key%' OR LOWER("SearchQuery") LIKE '%secret%' OR LOWER("SearchQuery") LIKE '%private key%'
--   OR LOWER("SearchQuery") LIKE '%connection string%' OR LOWER("SearchQuery") LIKE '%network diagram%'
--   OR LOWER("SearchQuery") LIKE '%architecture%' OR LOWER("SearchQuery") LIKE '%payroll%' OR LOWER("SearchQuery") LIKE '%salary%')
-- AND starttime > (CURRENT_TIMESTAMP - 86400000)
-- GROUP BY USERNAME HAVING COUNT(*) >= 3

high severity medium confidence

Detects data mining activity from Microsoft 365 SharePoint and OneDrive via Office 365 Management Activity logs ingested into QRadar (LOGSOURCETYPEID 397). Identifies bulk file access/download patterns exceeding 50 operations per hour and sensitive keyword search terms indicative of credential or architecture harvesting. Branch 2 covers SearchQueryPerformed events with sensitive keyword patterns.

Data Sources

IBM QRadar with Microsoft Office 365 DSMOffice 365 Management Activity API log source

Required Tables

events

False Positives & Tuning

Bulk content migration projects where administrators or migration tools download large volumes of files from SharePoint during tenant consolidations or M&A activities
End-user sync clients on new devices performing initial full library synchronization, generating hundreds of FileAccessed or FileSyncDownloadedFull events in a short window
Compliance or legal discovery tools performing keyword-based searches across SharePoint for eDiscovery requests, generating sensitive keyword search events

Download portable Sigma rule (.yml)

Other platforms for T1213

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Bulk SharePoint Document Download via PnP PowerShell
Expected signal: OfficeActivity events: Operation=FileDownloaded for each downloaded file, Workload=SharePoint, UserId=authenticated user UPN, ClientIP=executing machine IP. Azure AD SigninLogs: interactive authentication event for the SharePoint OAuth flow. Sysmon Event ID 1: Process Create for powershell.exe with PnP module loading.
Test 2SharePoint Sensitive Keyword Search via REST API
Expected signal: OfficeActivity events: Operation=SearchQueryPerformed for each API search call, with SearchQuery field containing the sensitive keyword, Workload=SharePoint, UserId=authenticated user. Multiple events in quick succession for each term searched.
Test 3Confluence REST API Page Enumeration and Export
Expected signal: Confluence access logs (atlassian-confluence.log): GET requests to /wiki/rest/api/space and /wiki/rest/api/search endpoints with user authentication. If Confluence audit logging is enabled: search events appear in Administration > Audit Log. Network proxy logs: HTTP requests to the Confluence FQDN with search query parameters visible in URL.
Test 4Microsoft Teams Message Export via Graph API
Expected signal: OfficeActivity events: Operation=MessageRead or similar Teams audit events, Workload=MicrosoftTeams. Azure AD SigninLogs: token acquisition for Graph API with Teams scopes. AuditLogs: Microsoft Graph API calls for Team and ChannelMessage read operations. Microsoft Defender for Cloud Apps: Graph API activity anomaly if CASB is configured.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1213 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Data from Information Repositories in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1213

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Collection

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1213

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (6)

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox