Esc

Data from Information Repositories - T1213

(ATT&CK® Technique)

Subtechniques

Definition

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1213["Data from Information Repositories"] --> |accesses| Resource["Resource"]; class T1213 OffensiveTechniqueNode;
        class Resource ArtifactNode; click Resource href "/dao/artifact/d3f:Resource";
        click T1213 href "/offensive-technique/attack/T1213/"; click Resource href "/dao/artifact/d3f:Resource"; T1213["Data from Information Repositories"] --> |reads| CodeRepository["Code Repository"]; class T1213 OffensiveTechniqueNode;
        class CodeRepository ArtifactNode; click CodeRepository href "/dao/artifact/d3f:CodeRepository";
        click T1213 href "/offensive-technique/attack/T1213/"; click CodeRepository href "/dao/artifact/d3f:CodeRepository"; T1213["Data from Information Repositories"] --> |accesses| WebFileResource["Web File Resource"]; class T1213 OffensiveTechniqueNode;
        class WebFileResource ArtifactNode; click WebFileResource href "/dao/artifact/d3f:WebFileResource";
        click T1213 href "/offensive-technique/attack/T1213/"; click WebFileResource href "/dao/artifact/d3f:WebFileResource";                                       DecoyNetworkResource["Decoy Network Resource"] -->
          | spoofs | WebFileResource["Web File Resource"];

          DecoyNetworkResource["Decoy Network Resource"] -.->
            | may-deceive | T1213["Data from Information Repositories"] ;
          class DecoyNetworkResource DefensiveTechniqueNode;
          class WebFileResource ArtifactNode;
          click DecoyNetworkResource href "/technique/d3f:DecoyNetworkResource";  RestoreDatabase["Restore Database"] -->
          | restores | CodeRepository["Code Repository"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1213["Data from Information Repositories"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class CodeRepository ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase";                        NetworkResourceAccessMediation["Network Resource Access Mediation"] -->
          | isolates | WebFileResource["Web File Resource"];

          NetworkResourceAccessMediation["Network Resource Access Mediation"] -.->
            | may-isolate | T1213["Data from Information Repositories"] ;
          class NetworkResourceAccessMediation DefensiveTechniqueNode;
          class WebFileResource ArtifactNode;
          click NetworkResourceAccessMediation href "/technique/d3f:NetworkResourceAccessMediation";

json