Data from Information Repositories: Databases (T1213.006)

Tactic: Collection · Platforms: IaaS, Linux, macOS, SaaS, Windows

The interactive view maps 1 detection strategy, 5 mitigations, 4 threat groups, 3 software entries, 3 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Data from Information Repositories (T1213).

Overview

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments).

Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for Lateral Movement, Command and Control, or Exfiltration. Data exfiltrated from databases may also be used to extort victims or may be sold for profit.

Explore

• Open T1213.006 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1213.006
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan