Home/ MITRE Matrix/ Collection/ T1213

T1213Data from Information Repositories

T1213 — Data from Information Repositories is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 6 detection use cases covering it and 5 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

6Use cases

5Articles

6Sub-techniques

1Tactic

Sub-techniques (6)

T1213.003 · Code Repositories T1213.001 · Confluence T1213.004 · Customer Relationship Management Software T1213.006 · Databases T1213.005 · Messaging Applications T1213.002 · Sharepoint

Use cases covering this technique (6)

[WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD [LLM] Bulk Matrix profile/room-member enumeration against Tchap endpoint Bespoke recon · hunting DSPDDCS [LLM] praisonai-platform CVE-2026-47416: Bulk agent/issue/project/comment enumeration immediately after a workspace role-change PATCH Bespoke actions · hunting SPDD [LLM] PraisonAI Platform cross-workspace nested-resource enumeration (CVE-2026-47407 IDOR) Bespoke actions · alerting SPDDCW [LLM] Hoppscotch cross-team request injection via moveRequest GraphQL with null nextRequestID Bespoke exploit · hunting SPDD [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (5)

med Over 73,000 French govt employees affected in Tchap messenger breach art-35

crit [GHSA / CRITICAL] CVE-2026-47416: praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{ art-162

crit [GHSA / CRITICAL] CVE-2026-47407: PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation art-164

high Aikido Attack finds multiple 0-days in Hoppscotch art-406

high 280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII art-573