MITRE ATT&CK - Técnica

T1213: Data from Information Repositories

Data from Information Repositories (T1213) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1213 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Data from Information Repositories deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Collection. As plataformas mapeadas pela MITRE incluem Linux, Windows, macOS, SaaS, IaaS e Office Suite. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Collection
Plataformas MITRE Linux, Windows, macOS, SaaS, IaaS, Office Suite

Descrição oficial original do MITRE ATT&CK

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account). The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository: * Policies, procedures, and standards

  • Physical / logical network diagrams
  • System architecture diagrams
  • Technical system documentation
  • Testing / development credentials (i.e., Unsecured Credentials) * Work / project schedules
  • Source code snippets
  • Links to network shares and other internal resources
  • Contact or other sensitive information about business partners and customers, including personally identifiable information (PII) Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following: * Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases * Collaboration platforms such as SharePoint, Confluence, and code repositories
  • Messaging platforms such as Slack and Microsoft Teams In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relational Database Service (RDS), Redis, or ElasticSearch.
Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Data from Information Repositories automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma