Data from Information Repositories (T1213) — ATT&CK

Events covered

3 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4688	A new process has been created.

Authoring guide

These 59 rules share fields, values, and exclusions.

Fields filtered most (70 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	12	`eq` 7, `in` 4, `wildcard` 1	`git.clone`, `ProcessRollup2`, `exec`, `Process Create*`, `SearchQueryPerformed`
`data_stream.dataset`	12	`eq` 12	`aws.cloudtrail`, `github.audit`, `o365.audit`, `azure.platformlogs`, `azure.signinlogs`
`event.outcome`	7	`eq` 7	`success`
`Provider_Name`	6	`eq` 5, `in` 1	`dynamodb.amazonaws.com`, `SharePoint`, `onedrive`, `rds.amazonaws.com`, `secretsmanager.amazonaws.com`
`DataSource`	5	`eq` 5	`HR_PA_CHANGELOG`, `RAL_AUDIT`, `RAL_DATA`, `SLG1_ODATA`, `SPOOL_REQUEST`
`logtype`	5	`eq` 5	`16001`, `17001`, `8001`, `9001`, `9002`
`AlertSeverity_s`	4	`eq` 4	`High`, `Informational`, `Low`, `Medium`
`EventID`	4	`eq` 4	`git.clone`, `4662`, `personal_access_token.access_granted`, `repo.download_zip`
`action`	4	`eq` 3, `in` 1	`codespaces.destroy`, `create`, `destroy`, `environment.delete`, `org.remove_outside_collaborator`
`auditType.action`	4	`eq` 4	`full data export triggered`, `unauthorized full data export triggered`, `user details export failed`, `user details export started`, `user details exported`
`auditType.category`	4	`eq` 4	`data pipeline`, `users and groups`
`event.category`	4	`eq` 4	`configuration`, `process`
`event.type`	4	`eq` 4	`start`, `change`
`github.repository_public`	4	`eq` 4	`false`
`host.os.type`	3	`eq` 3

Top indicator values (270 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS DynamoDB Scan by Unusual User elasticAWS DynamoDB Table Exported to S3 elasticAWS RDS Snapshot Export elasticAWS Secrets Manager Rapid Secrets Retrieval elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticM365 SharePoint Search for Sensitive Content elasticM365 SharePoint/OneDrive File Access via PowerShell	7	375
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS DynamoDB Scan by Unusual User elasticAWS DynamoDB Table Exported to S3 elasticAWS RDS Snapshot Export elasticAWS Secrets Manager Rapid Secrets Retrieval	4	173
`data_stream.dataset`	`eq`	`github.audit` elasticGithub Activity on a Private Repository from an Unusual IP elasticGitHub Exfiltration via High Number of Repository Clones by User elasticHigh Number of Cloned GitHub Repos From PAT	3	18
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 SharePoint Search for Sensitive Content elasticM365 SharePoint/OneDrive File Access via PowerShell	2	47
`github.repository_public`	`eq`	`false` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticGithub Activity on a Private Repository from an Unusual IP elasticHigh Number of Cloned GitHub Repos From PAT	4	5
`event.category`	`eq`	`configuration` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticHigh Number of Cloned GitHub Repos From PAT	3	13
`event.type`	`eq`	`start` elasticPotential Database Dumping Activity elasticPotential Secret Scanning via Gitleaks elasticPotential Veeam Credential Access Command	3	1087
`id.applicationName`	`eq`	`drive` pantherExternal GSuite File Share pantherGSuite External Drive Document pantherGSuite Overly Visible Drive Document	3	5
`EventID`	`eq`	`git.clone` chronicleGitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories chronicleGitHub High Number Of Non Public GitHub Repositories Cloned	2	2
`EventType`	`eq`	`git.clone` elasticGitHub Exfiltration via High Number of Repository Clones by User elasticHigh Number of Cloned GitHub Repos From PAT	2	2
`Provider_Name`	`eq`	`dynamodb.amazonaws.com` elasticAWS DynamoDB Scan by Unusual User elasticAWS DynamoDB Table Exported to S3	2	2
`auditType.category`	`eq`	`data pipeline` sigmaBitbucket Full Data Export Triggered sigmaBitbucket Unauthorized Full Data Export Triggered	2	2
`auditType.category`	`eq`	`users and groups` sigmaBitbucket User Details Export Attempt Detected sigmaBitbucket User Permissions Export Attempt	2	2
`event.dataset`	`eq`	`github.audit` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo	2	14
`type`	`eq`	`acl_change` pantherExternal GSuite File Share pantherGSuite External Drive Document	2	2
`AlertSeverity_s`	`eq`	`High` kustoVaronis - High severity alerts detected	1
`AlertSeverity_s`	`eq`	`Informational` kustoVaronis - Informational alerts detected	1
`AlertSeverity_s`	`eq`	`Low` kustoVaronis - Low severity alerts detected	1
`AlertSeverity_s`	`eq`	`Medium` kustoVaronis - Medium severity alerts detected	1
`Category`	`eq`	`SQLSecurityAuditEvents` kustoResponse rows stateful anomaly on database	1	12
`DataSource`	`eq`	`HR_PA_CHANGELOG` kustoPathlock TDnR - HR User Master Change Requests	1
`DataSource`	`eq`	`RAL_AUDIT` kustoPathlock TDnR - SAP Read Access Logging Audit	1
`DataSource`	`eq`	`RAL_DATA` kustoPathlock TDnR - SAP Read Access Logging Data	1
`DataSource`	`eq`	`SLG1_ODATA` kustoPathlock TDnR - OData Application Log Events	1
`DataSource`	`eq`	`SPOOL_REQUEST` kustoPathlock TDnR - Spool Job Changes	1
`Esql.azure_platformlogs_identity_claim_upn_count_distinct`	`eq`	`1` elasticAzure Key Vault Excessive Secret or Key Retrieved	1
`Esql.event_action_count_distinct`	`ge`	`2` elasticAzure Key Vault Excessive Secret or Key Retrieved	1
`Esql.event_count`	`ge`	`10` elasticAzure Key Vault Excessive Secret or Key Retrieved	1	8
`Esql.event_count`	`ge`	`25` elasticGitHub Exfiltration via High Number of Repository Clones by User	1
`EventData`	`contains`	`search` splunkO365 SharePoint Suspicious Search Behavior	1

Exclusions (43 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`AADEmail`	`eq`	`[]` kustoUsers searching for VIP user activity	1
`AccessMask`	`in`	`0x0` elasticAccess to a Sensitive LDAP Attribute	1
`AccessMask`	`in`	`0x100` elasticAccess to a Sensitive LDAP Attribute	1
`SubjectUserSid`	`eq`	`s-1-5-18` elasticAccess to a Sensitive LDAP Attribute	1
`aws::sourceIPAddress`	`in`	`apidestinations.events.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`aws::sourceIPAddress`	`in`	`kafka.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`azure.signinlogs.properties.app_owner_tenant_id`	`eq`	`f8cdef31-a31e-4b4a-93e4-5f571e91255a` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`00000003-0000-0ff1-ce00-000000000000` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`08e18876-6177-487e-b8b5-cf950c1e598c` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`5e3ce6c0-2b1f-4285-8d4b-75ee78787346` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`9199bf20-a13f-4107-85dc-02114787ef48` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`ab9b8c07-8f02-4f72-87fa-80105867a763` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`af124e86-4e96-495a-b70a-90f90ab96707` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`cc15fd57-2c6c-4117-a88c-83b1d56b4bbe` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::signin_category`	`eq`	`microsoftserviceprincipalsigninlogs` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1

Data from Information Repositories `T1213`

Events covered

Authoring guide

Fields filtered most (70 distinct)

Top indicator values (270 distinct)

Exclusions (43 distinct)

Rules under this technique

Sigma 12 rules

Elastic 20 rules

Splunk 1 rule

Kusto 13 rules

YARA-L 3 rules

Panther 10 rules

Data from Information Repositories T1213

Events covered

Authoring guide

Fields filtered most (70 distinct)

Top indicator values (270 distinct)

Exclusions (43 distinct)

Rules under this technique

Sigma 12 rules

Elastic 20 rules

Splunk 1 rule

Kusto 13 rules

YARA-L 3 rules

Panther 10 rules

Data from Information Repositories `T1213`