MITRE ATT&CK technique
Data from Information Repositories detection rulesT1213
Data from Information Repositories (T1213) is a MITRE ATT&CK technique in the Collection tactic. This page lists the 12 community-maintained Sigma detection rules in the library mapped to T1213 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target opencanary, bitbucket, github.
Top products
Tactic
Bitbucket Unauthorized Full Data Export Triggered
criticalDetects when full data export is attempted an unauthorized user.
bitbucket
Bitbucket Full Data Export Triggered
highDetects when full data export is attempted.
bitbucket
OpenCanary - GIT Clone Request
highDetects instances where a GIT service on an OpenCanary node has had Git Clone request.
opencanary · application
OpenCanary - MSSQL Login Attempt Via SQLAuth
highDetects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
opencanary · application
OpenCanary - MSSQL Login Attempt Via Windows Authentication
highDetects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
opencanary · application
OpenCanary - MySQL Login Attempt
highDetects instances where a MySQL service on an OpenCanary node has had a login attempt.
opencanary · application
OpenCanary - REDIS Action Command Attempt
highDetects instances where a REDIS service on an OpenCanary node has had an action command attempted.
opencanary · application
Bitbucket User Details Export Attempt Detected
mediumDetects user data export activity.
bitbucket
Bitbucket User Permissions Export Attempt
mediumDetects user permission data export attempt.
bitbucket
Github Delete Action Invoked
mediumDetects delete action in the Github audit logs for codespaces, environment, project and repo.
github
Github Outside Collaborator Detected
mediumDetects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
github
Github Self Hosted Runner Changes Detected
lowA self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.
github