T1213 — Data from Information Repositories

# T1213 - Data from Information Repositories

## SOC Recommendation
Investigate Data from Information Repositories activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Resource Access Mediation | Isolate | Apply Network Resource Access Mediation to contain the blast radius once this technique is observed. |
| Restore Database | Restore | Use Restore Database to recover affected systems or data after containment. |
| Decoy Network Resource | Deceive | Deploy Decoy Network Resource to detect and mislead an adversary attempting this technique. |
| Data Inventory | Model | Use Data Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let lookback = 1h;
let highUniqueFileThreshold = 50;
let highDownloadThreshold = 100;
let officeActivitySource =
    union isfuzzy=true OfficeActivity,
    (datatable(TimeGenerated:datetime, OfficeWorkload:string, RecordType:string, Operation:string, UserId:string, ClientIP:string, UserAgent:string, SourceFileName:string, SiteUrl:string, Site_Url:string, ObjectId:string)[]);
officeActivitySource
| where TimeGenerated >= ago(lookback)
| where OfficeWorkload in~ ("SharePoint", "OneDrive") or RecordType in ("SharePointFileOperation", "OneDrive")
| where Operation in~ (
    "FileDownloaded", "FileSyncDownloadedFull", "FileSyncDownloadedPartial",
    "FileCopied", "FileAccessed", "FileCheckedOut", "FileVersionDownloaded", "PageViewed"
)
| extend UserPrincipalName = tolower(tostring(UserId)),
         Site = tostring(coalesce(SiteUrl, Site_Url)),
         FileKey = tostring(coalesce(ObjectId, SourceFileName))
| where isnotempty(UserPrincipalName)
| summarize
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    FileEventCount = count(),
    DownloadCount = countif(Operation in~ ("FileDownloaded", "FileSyncDownloadedFull", "FileSyncDownloadedPartial", "FileVersionDownloaded")),
    UniqueFiles = dcount(FileKey),
    UniqueSites = dcount(Site),
    FileSample = make_set(SourceFileName, 20),
    Sites = make_set(Site, 20)
    by UserPrincipalName, ClientIP, UserAgent
| where UniqueFiles > highUniqueFileThreshold or DownloadCount >= highDownloadThreshold
| extend ThresholdTier = case(
    UniqueFiles > highUniqueFileThreshold and DownloadCount >= highDownloadThreshold, "unique_files_and_downloads",
    UniqueFiles > highUniqueFileThreshold, "unique_files",
    "downloads"
)
| extend TimeGenerated = EndTime,
         timestamp = EndTime,
         AccountCustomEntity = UserPrincipalName,
         IPCustomEntity = ClientIP
| order by UniqueFiles desc, DownloadCount desc
```
```kql
// High severity - Social and Public Exposure - Confidential Files Information Exposure
let timeFrame = 5m;
CyfirmaSPEConfidentialFilesAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Impact=impact,
    Recommendation=recommendation,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Impact,
    Recommendation,
    ProductName,
    ProviderName,
    AlertTitle
```
```kql
// High severity - Social and Public Exposure - Exposure of PII/CII in Public Domain
let timeFrame = 5m;
CyfirmaSPEPIIAndCIIAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    AssetType=asset_type,
    AssetValue=signature,
    Source=source,
    Impact=impact,
    Recommendation=recommendation,
    PostedDate=posted_date,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT',
    AlertTitle=Alert_title
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    AssetType,
    AssetValue,
    Source,
    Impact,
    Recommendation,
    PostedDate,
    ProductName,
    ProviderName,
    AlertTitle
```

## Escalation Criteria
- Data from Information Repositories activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1213.json
• /api/recommendations/T1213.json
• /api/d3fend/T1213.json
• /api/mappings/T1213.json
• /api/confluence/T1213.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1213.json

Response:

{
  "technique_id": "T1213",
  "name": "Data from Information Repositories",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "Linux",
    "Windows",
    "macOS",
    "SaaS",
    "IaaS",
    "Office Suite"
  ],
  "summary": "Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information...",
  "soc_recommendation": "Investigate Data from Information Repositories activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NRAM",
      "name": "Network Resource Access Mediation",
      "relationship": "isolate",
      "practical_action": "Apply Network Resource Access Mediation to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-RD",
      "name": "Restore Database",
      "relationship": "restore",
      "practical_action": "Use Restore Database to recover affected systems or data after containment.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-DNR",
      "name": "Decoy Network Resource",
      "relationship": "deceive",
      "practical_action": "Deploy Decoy Network Resource to detect and mislead an adversary attempting this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-DI",
      "name": "Data Inventory",
      "relationship": "model",
      "practical_action": "Use Data Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed data from information repositories activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"SharePoint OneDrive Mass Document Access\" -- Flags high-volume SharePoint/OneDrive access/download behavior. CO-001 now covers external sharing-link creation, so this rule owns the mass-access tier."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CO-006 — SharePoint OneDrive Mass Document Access",
        "description": "Flags high-volume SharePoint/OneDrive access/download behavior. CO-001 now covers external sharing-link creation, so this rule owns the mass-access tier. (Source: Bell Integration baseline detection library, mapped via sub-technique T1213.002.)",
        "query": "let lookback = 1h;\nlet highUniqueFileThreshold = 50;\nlet highDownloadThreshold = 100;\nlet officeActivitySource =\n    union isfuzzy=true OfficeActivity,\n    (datatable(TimeGenerated:datetime, OfficeWorkload:string, RecordType:string, Operation:string, UserId:string, ClientIP:string, UserAgent:string, SourceFileName:string, SiteUrl:string, Site_Url:string, ObjectId:string)[]);\nofficeActivitySource\n| where TimeGenerated >= ago(lookback)\n| where OfficeWorkload in~ (\"SharePoint\", \"OneDrive\") or RecordType in (\"SharePointFileOperation\", \"OneDrive\")\n| where Operation in~ (\n    \"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncDownloadedPartial\",\n    \"FileCopied\", \"FileAccessed\", \"FileCheckedOut\", \"FileVersionDownloaded\", \"PageViewed\"\n)\n| extend UserPrincipalName = tolower(tostring(UserId)),\n         Site = tostring(coalesce(SiteUrl, Site_Url)),\n         FileKey = tostring(coalesce(ObjectId, SourceFileName))\n| where isnotempty(UserPrincipalName)\n| summarize\n    StartTime = min(TimeGenerated),\n    EndTime = max(TimeGenerated),\n    FileEventCount = count(),\n    DownloadCount = countif(Operation in~ (\"FileDownloaded\", \"FileSyncDownloadedFull\", \"FileSyncDownloadedPartial\", \"FileVersionDownloaded\")),\n    UniqueFiles = dcount(FileKey),\n    UniqueSites = dcount(Site),\n    FileSample = make_set(SourceFileName, 20),\n    Sites = make_set(Site, 20)\n    by UserPrincipalName, ClientIP, UserAgent\n| where UniqueFiles > highUniqueFileThreshold or DownloadCount >= highDownloadThreshold\n| extend ThresholdTier = case(\n    UniqueFiles > highUniqueFileThreshold and DownloadCount >= highDownloadThreshold, \"unique_files_and_downloads\",\n    UniqueFiles > highUniqueFileThreshold, \"unique_files\",\n    \"downloads\"\n)\n| extend TimeGenerated = EndTime,\n         timestamp = EndTime,\n         AccountCustomEntity = UserPrincipalName,\n         IPCustomEntity = ClientIP\n| order by UniqueFiles desc, DownloadCount desc"
      },
      {
        "name": "67e9c4aa-a2fa-4e4e-9272-1a8da41475c6 — CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule",
        "description": "\"This rule detects high-severity alerts from CYFIRMA regarding exposure of confidential files or forms linked to internal or client-related information, publicly accessible on platforms. These exposures could lead to data leakage, compliance violations, or targeted attacks.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// High severity - Social and Public Exposure - Confidential Files Information Exposure\nlet timeFrame = 5m;\nCyfirmaSPEConfidentialFilesAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    AlertUID=alert_uid,\n    UID=uid,\n    AssetType=asset_type,\n    AssetValue=signature,\n    Impact=impact,\n    Recommendation=recommendation,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT',\n    AlertTitle=Alert_title\n| project\n    TimeGenerated,\n    Description,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    AlertUID,\n    UID,\n    AssetType,\n    AssetValue,\n    Impact,\n    Recommendation,\n    ProductName,\n    ProviderName,\n    AlertTitle"
      },
      {
        "name": "52d71822-41e4-4c21-b36f-400294f2b43a — CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule",
        "description": "\"This analytics rule detects high severity alerts from CYFIRMA indicating exposure of Personally Identifiable Information (PII) or Confidential Information (CII) in public or unsecured sources. Such leaks may include email addresses, credentials, phone numbers, or other sensitive personal or organizational data. These exposures can lead to identity theft, phishing, credential compromise, or regulatory non-compliance. Investigate promptly and initiate remediation steps including user notifications and credential resets.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// High severity - Social and Public Exposure - Exposure of PII/CII in Public Domain\nlet timeFrame = 5m;\nCyfirmaSPEPIIAndCIIAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    RiskScore=risk_score,\n    AlertUID=alert_uid,\n    UID=uid,\n    AssetType=asset_type,\n    AssetValue=signature,\n    Source=source,\n    Impact=impact,\n    Recommendation=recommendation,\n    PostedDate=posted_date,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT',\n    AlertTitle=Alert_title\n| project\n    TimeGenerated,\n    Description,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    AlertUID,\n    UID,\n    AssetType,\n    AssetValue,\n    Source,\n    Impact,\n    Recommendation,\n    PostedDate,\n    ProductName,\n    ProviderName,\n    AlertTitle"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "c07f7898-5dc3-11f0-9f27-f661ea17fbcd — Azure Key Vault Excessive Secret or Key Retrieved",
        "description": "(ESQL) Identifies excessive secret or key retrieval operations from Azure Key Vault. This rule detects when a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short time frame, which may indicate potential abuse or unauthorized access attempts... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-azure.platformlogs-* metadata _id, _index\n\n// Filter for Azure Key Vault read operations\n| where data_stream.dataset == \"azure.platformlogs\"\n  and event.action in (\n    \"VaultGet\",\n    \"KeyGet\",\n    \"KeyList\",\n    \"KeyListVersions\",\n    \"KeyGetDeleted\",\n    \"KeyListDeleted\",\n    \"SecretGet\",\n    \"SecretList\",\n    \"SecretListVersions\",\n    \"SecretGetDeleted\",\n    \"SecretListDeleted\",\n    \"CertificateGet\",\n    \"CertificateList\",\n    \"CertificateListVersions\",\n    \"CertificateGetDeleted\",\n    \"CertificateListDeleted\",\n    \"CertificatePolicyGet\",\n    \"CertificateContactsGet\",\n    \"CertificateIssuerGet\",\n    \"CertificateIssuersList\"\n  )\n\n// Truncate timestamps into 1-minute windows\n| eval Esql.time_window_date_trunc = date_trunc(1 minute, @timestamp)\n\n// Aggregate identity, geo, resource, and activity info\n| stats\n    Esql_priv.azure_platformlogs_identity_claim_upn_values = values(azure.platformlogs.identity.claim.upn),\n    Esql.azure_platformlogs_identity_claim_upn_count_distinct = count_distinct(azure.platformlogs.identity.claim.upn),\n    Esql.azure_platformlogs_identity_claim_appid_values = values(azure.platformlogs.identity.claim.appid),\n\n    Esql.source_ip_values = values(source.ip),\n    Esql.source_geo_city_values = values(source.geo.city_name),\n    Esql.source_geo_region_values = values(source.geo.region_name),\n    Esql.source_geo_country_values = values(source.geo.country_name),\n    Esql.source_as_organization_name_values = values(source.as.organization.name),\n\n    Esql.event_action_values = values(event.action),\n    Esql.event_count = count(*),\n    Esql.event_action_count_distinct = count_distinct(event.action),\n    Esql.azure_resource_name_count_distinct = count_distinct(azure.resource.name),\n    Esql.azure_resource_name_values = values(azure.resource.name),\n    Esql.azure_platformlogs_result_type_values = values(azure.platformlogs.result_type),\n    Esql.cloud_region_values = values(cloud.region),\n\n    Esql.agent_name_values = values(agent.name),\n    Esql.azure_subscription_id_values = values(azure.subscription_id),\n    Esql.azure_resource_group_values = values(azure.resource.group),\n    Esql.azure_resource_id_values = values(azure.resource.id)\n\nby Esql.time_window_date_trunc, azure.platformlogs.identity.claim.upn\n\n// keep relevant fields\n| keep\n    Esql.time_window_date_trunc,\n    Esql_priv.azure_platformlogs_identity_claim_upn_values,\n    Esql.azure_platformlogs_identity_claim_upn_count_distinct,\n    Esql.azure_platformlogs_identity_claim_appid_values,\n    Esql.source_ip_values,\n    Esql.source_geo_city_values,\n    Esql.source_geo_region_values,\n    Esql.source_geo_country_values,\n    Esql.source_as_organization_name_values,\n    Esql.event_action_values,\n    Esql.event_count,\n    Esql.event_action_count_distinct,\n    Esql.azure_resource_name_count_distinct,\n    Esql.azure_resource_name_values,\n    Esql.azure_platformlogs_result_type_values,\n    Esql.cloud_region_values,\n    Esql.agent_name_values,\n    Esql.azure_subscription_id_values,\n    Esql.azure_resource_group_values,\n    Esql.azure_resource_id_values\n\n// Filter for suspiciously high volume of distinct Key Vault reads by a single actor\n| where Esql.azure_platformlogs_identity_claim_upn_count_distinct == 1 and Esql.event_count >= 10 and Esql.event_action_count_distinct >= 2\n\n| sort Esql.time_window_date_trunc desc"
      },
      {
        "name": "19f3674c-f4a1-43bb-a89c-e4c6212275e0 — GitHub Exfiltration via High Number of Repository Clones by User",
        "description": "(ESQL) Detects a high number of repository cloning actions by a single user within a short time frame. Adversaries may clone multiple repositories to exfiltrate sensitive data. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-github.audit-* metadata _id, _index, _version\n| where\n  data_stream.dataset == \"github.audit\" and event.type == \"change\" and event.action == \"git.clone\"\n| stats\n  Esql.event_count = COUNT(*),\n  Esql.github_org_values = values(github.org),\n  Esql.github_repo_values = values(github.repo),\n  Esql.github_repository_public_values = values(github.repository_public),\n  Esql.github_token_id_values = values(github.token_id),\n  Esql.github_user_agent_values = values(github.user_agent),\n  Esql.user_name_values = values(user.name),\n  Esql.agent_id_values = values(agent.id),\n  Esql.data_stream_dataset_values = values(data_stream.dataset),\n  Esql.data_stream_namespace_values = values(data_stream.namespace)\n\n  by user.name\n\n| keep Esql.*\n\n| where\n  Esql.event_count >= 25"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Data from Information Repositories activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1213 - Data from Information Repositories Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}