T1213Collection
Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports1
Detections
7 Sigma rules tagged T1213Data from Information RepositoriesT12137 general rules
- OpenCanary - GIT Clone Requesthightest
- OpenCanary - MSSQL Login Attempt Via SQLAuthhightest
- OpenCanary - MSSQL Login Attempt Via Windows Authenticationhightest
- OpenCanary - MySQL Login Attempthightest
- OpenCanary - REDIS Action Command Attempthightest
- Bitbucket User Details Export Attempt Detectedmediumtest
- Bitbucket User Permissions Export Attemptmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Data from Information Repositories
4 CVEs, by priority. Each link shows its badge.- CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass VulnerabilityIvanti · Endpoint Manager Mobile (EPMM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1136Create Account+1 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%79.9priority
- CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityAdobe · Commerce and Magento Open SourceKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1027Obfuscated Files or Information+1 moreMITRE CTID mapping of the KEV entry · follow-on activity99.2%Top 0.07%69.8priority
- CVE-2019-2616Oracle BI Publisher Unauthorized Access VulnerabilityOracle · BI Publisher (Formerly XML Publisher)KEVPublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1213Data from Information Repositories+1 moreAI mapping from the description · primary impact92.2%Top 0.18%68.0priority
- CVE-2018-18995Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be…MITRE CTID mapping of the CVE · follow-on activity2.6%Top 14%17.1priority