Data from Information Repositories: Sharepoint
- ID
- T1213.002
- Tactics
- TA0009 Collection
- Sub-technique of
- T1213 Data from Information Repositories
- Platforms
- Office Suite, Windows
- Data sources
- Application Log Content, Logon Session Creation, Cloud Service Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 8 Oct 2026
Adversaries may leverage the SharePoint repository as a source to mine valuable information.[1] SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
- Policies, procedures, and standards
- Physical / logical network diagrams
- System architecture diagrams
- Technical system documentation
- Testing / development credentials (i.e., Unsecured Credentials)
- Work / project schedules
- Source code snippets
- Links to network shares and other internal resources
Detection
- DET0500 Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users
Data components: Application Log Content, Logon Session Creation, Cloud Service Metadata
Mitigations (3)
- M1017 User Training
Develop and publish policies that define acceptable information to be stored in SharePoint repositories.
- M1018 User Account Management
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.
- M1047 Audit
Consider periodic review of accounts and privileges for critical and sensitive SharePoint repositories.
Groups (8)
- G0004 Ke3chang
- G0007 APT28
- G0114 Chimera
- G0125 HAFNIUM
- G1004 LAPSUS$
- G1024 Akira
- G1055 VOID MANTICORE
- G1059 NIMBUS MANTICORE