Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:
Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following:
In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relational Database Service (RDS), Redis, or ElasticSearch.[1][2][3]
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 |
APT28 has collected files from various information repositories.[4] |
| C0040 | APT41 DUST |
APT41 DUST collected data from victim Oracle databases using SQLULDR2.[5] |
| G0037 | FIN6 |
FIN6 has collected schemas and user accounts from systems running SQL Server.[6] |
| S1146 | MgBot |
MgBot includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.[7] |
| S0598 | P.A.S. Webshell |
P.A.S. Webshell has the ability to list and extract data from SQL databases.[8] |
| S1148 | Raccoon Stealer |
Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.[9] |
| G0034 | Sandworm Team |
Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.[10] |
| C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.[11] |
| G0010 | Turla |
Turla has used a custom .NET tool to collect documents from an organization's internal central database.[12] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Consider periodic review of accounts and privileges for critical and sensitive repositories. Ensure that repositories such as cloud-hosted databases are not unintentionally exposed to the public, and that security groups assigned to them permit only necessary and authorized hosts.[13] |
| M1041 | Encrypt Sensitive Information |
Encrypt data stored at rest in databases. |
| M1032 | Multi-factor Authentication |
Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator. |
| M1060 | Out-of-Band Communications Channel |
Create plans for leveraging a secure out-of-band communications channel, rather than existing in-network chat applications, in case of a security incident.[14] |
| M1054 | Software Configuration |
Consider implementing data retention policies to automate periodically archiving and/or deleting data that is no longer needed. |
| M1018 | User Account Management |
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization. |
| M1017 | User Training |
Develop and publish policies that define acceptable information to be stored in repositories. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor for third-party application logging, messaging, and/or other artifacts that may leverage information repositories to mine valuable information. Information repositories generally have a considerably large user base, detection of malicious use can be non-trivial. At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies. |
| DS0028 | Logon Session | Logon Session Creation |
Monitor for newly constructed logon behavior within Microsoft's SharePoint can be configured to report access to certain pages and documents. [15] Sharepoint audit logging can also be configured to report when a user shares a resource. [16] The user access logging within Atlassian's Confluence can also be configured to report access to certain pages and documents through AccessLogFilter. [17] In AWS environments, GuardDuty can be configured to report suspicious login activity in services such as RDS.[18] Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities. |