Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Collection/ T1213

T1213Data from Information Repositories

T1213 — Data from Information Repositories is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 12 detection use cases covering it and 9 threat-intel articles citing it.

Collection
View on the matrix → Filter Detection Library MITRE official spec ↗
12Use cases
9Articles
6Sub-techniques
1Tactic

Sub-techniques (6)

T1213.003 · Code RepositoriesT1213.001 · ConfluenceT1213.004 · Customer Relationship Management SoftwareT1213.006 · DatabasesT1213.005 · Messaging ApplicationsT1213.002 · Sharepoint

Use cases covering this technique (12)

[WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD [LLM] Bulk cadastral record enumeration/scraping from DGFiP SPDC portal (apexappliext.dgfip.finances.gouv.fr) Bespoke actions · alerting SP [LLM] Flowise mass OAuth token harvest — burst of successful refreshes across credentials Bespoke actions · alerting SP [LLM] Gitea Actions V4 artifact signed-URL forgery via oversized artifactID (CVE-2026-58426) Bespoke exploit · alerting SΣP [LLM] Gitea runner enumerating cross-task DownloadArtifact contexts (CVE-2026-58426 read path) Bespoke actions · hunting SP [LLM] LightRAG CVE-2026-61736: cross-origin credentialed read of /documents or /query (data exfil) Bespoke actions · hunting SP [LLM] MantisBT SOAP endpoint (mantisconnect.php) high-volume POST burst — mass data exfiltration Bespoke actions · alerting SP [LLM] n8n-MCP cross-tenant workflow version read/enumeration via n8n_workflow_versions (CVE-2026-54052) Bespoke recon · hunting SP [LLM] Rocket.Chat Livechat file-upload ID enumeration sweep (ObjectId harvest) Bespoke actions · alerting SP [LLM] Rocket.Chat anonymous Livechat visitor bootstrap chained to file-upload access Bespoke exploit · alerting SP [LLM] Klue/Icarus: bulk Salesforce CRM record retrieval via connected app (Case/Contact/Account/Opportunity) Bespoke actions · alerting DSP [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (9)

med French tax authority data breach affects 678,000 individuals art-24
crit [GHSA / CRITICAL] CVE-2026-70478: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any art-121
crit [GHSA / CRITICAL] CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task art-229
crit [GHSA / CRITICAL] CVE-2026-61736: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests art-243
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-266
crit [GHSA / CRITICAL] CVE-2026-54052: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments art-272
high Predicting MongoDB ObjectId continuously in Rocket.Chat art-319
high When a vendor's breach becomes yours: lessons from the Klue incident art-356
high 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII art-704