Data from Information Repositories: Databases `T1213.006`

Tactic: Collection

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments).

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	2	`eq` 2	`getsecretvalue`, `startexporttask`
`Provider_Name`	2	`eq` 2	`rds.amazonaws.com`, `secretsmanager.amazonaws.com`
`data_stream.dataset`	2	`eq` 2	`aws.cloudtrail`
`event.outcome`	2	`eq` 2	`success`
`Category`	1	`eq` 1	`SQLSecurityAuditEvents`
`IsVolumeAnomalyOnVal`	1	`eq` 1	`true`
`WindowType`	1	`eq` 1, `in` 1	`detection`, `training`
`action_id_s`	1	`contains` 1	`bcm`, `rcm`

Top indicator values (14 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS RDS Snapshot Export elasticAWS Secrets Manager Rapid Secrets Retrieval	2	173
`event.outcome`	`eq`	`success` elasticAWS RDS Snapshot Export elasticAWS Secrets Manager Rapid Secrets Retrieval	2	375
`Category`	`eq`	`SQLSecurityAuditEvents` kustoResponse rows stateful anomaly on database	1	12
`EventType`	`eq`	`getsecretvalue` elasticAWS Secrets Manager Rapid Secrets Retrieval	1	3
`EventType`	`eq`	`startexporttask` elasticAWS RDS Snapshot Export	1
`IsVolumeAnomalyOnVal`	`eq`	`true` kustoResponse rows stateful anomaly on database	1	2
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS Snapshot Export	1	9
`Provider_Name`	`eq`	`secretsmanager.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1	2
`WindowType`	`eq`	`detection` kustoResponse rows stateful anomaly on database	1	10
`WindowType`	`eq`	`training` kustoResponse rows stateful anomaly on database	1	10
`WindowType`	`in`	`detection` kustoResponse rows stateful anomaly on database	1	10
`WindowType`	`in`	`training` kustoResponse rows stateful anomaly on database	1	10
`action_id_s`	`contains`	`bcm` kustoResponse rows stateful anomaly on database	1	10
`action_id_s`	`contains`	`rcm` kustoResponse rows stateful anomaly on database	1	10

Exclusions (8 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::sourceIPAddress`	`in`	`apidestinations.events.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`aws::sourceIPAddress`	`in`	`kafka.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`brave` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`chrome` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`edge` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`firefox` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`opera` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`safari` elasticAWS Secrets Manager Rapid Secrets Retrieval	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Elastic 2 rules

Kusto 1 rule

Response rows stateful anomaly on database

Data from Information Repositories: Databases T1213.006