# T1213 - Data from Information Repositories

## SOC Recommendation
Investigate Data from Information Repositories activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Resource Access Mediation | Isolate | Apply Network Resource Access Mediation to contain the blast radius once this technique is observed. |
| Restore Database | Restore | Use Restore Database to recover affected systems or data after containment. |
| Decoy Network Resource | Deceive | Deploy Decoy Network Resource to detect and mislead an adversary attempting this technique. |
| Data Inventory | Model | Use Data Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let lookback = 1h;
let highUniqueFileThreshold = 50;
let highDownloadThreshold = 100;
let officeActivitySource =
    union isfuzzy=true OfficeActivity,
    (datatable(TimeGenerated:datetime, OfficeWorkload:string, RecordType:string, Operation:string, UserId:string, ClientIP:string, UserAgent:string, SourceFileName:string, SiteUrl:string, Site_Url:string, ObjectId:string)[]);
officeActivitySource
| where TimeGenerated >= ago(lookback)
| where OfficeWorkload in~ ("SharePoint", "OneDrive") or RecordType in ("SharePointFileOperation", "OneDrive")
| where Operation in~ (
    "FileDownloaded", "FileSyncDownloadedFull", "FileSyncDownloadedPartial",
    "FileCopied", "FileAccessed", "FileCheckedOut", "FileVersionDownloaded", "PageViewed"
)
| extend UserPrincipalName = tolower(tostring(UserId)),
         Site = tostring(coalesce(SiteUrl, Site_Url)),
         FileKey = tostring(coalesce(ObjectId, SourceFileName))
| where isnotempty(UserPrincipalName)
| summarize
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    FileEventCount = count(),
    DownloadCount = countif(Operation in~ ("FileDownloaded", "FileSyncDownloadedFull", "FileSyncDownloadedPartial", "FileVersionDownloaded")),
    UniqueFiles = dcount(FileKey),
    UniqueSites = dcount(Site),
    FileSample = make_set(SourceFileName, 20),
    Sites = make_set(Site, 20)
    by UserPrincipalName, ClientIP, UserAgent
| where UniqueFiles > highUniqueFileThreshold or DownloadCount >= highDownloadThreshold
| extend ThresholdTier = case(
    UniqueFiles > highUniqueFileThreshold and DownloadCount >= highDownloadThreshold, "unique_files_and_downloads",
    UniqueFiles > highUniqueFileThreshold, "unique_files",
    "downloads"
)
| extend TimeGenerated = EndTime,
         timestamp = EndTime,
         AccountCustomEntity = UserPrincipalName,
         IPCustomEntity = ClientIP
| order by UniqueFiles desc, DownloadCount desc
```
```kql
// High severity - Social and Public Exposure - Confidential Files Information Exposure
let timeFrame = 5m;
CyfirmaSPEConfidentialFilesAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Impact=impact,
    Recommendation=recommendation,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    ProductName,
    ProviderName,
    AlertTitle
```
```kql
// High severity - Social and Public Exposure - Exposure of PII/CII in Public Domain
let timeFrame = 5m;
CyfirmaSPEPIIAndCIIAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Source=source,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Source,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName,
    AlertTitle
```

## Escalation Criteria
- Data from Information Repositories activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.