Data from Information Repositories (T1213) is the collection step after access: an adversary mines SharePoint, Confluence, wikis and code repositories for credentials, network diagrams and secrets. It rarely trips an endpoint alert, because it looks like a valid account using an app it may use. The signal lives in the cloud audit log: search intent and volume.
Practice detecting Data from Information Repositories on realistic SIEM alerts in SOCSimulator Operations.
“Data from Information Repositories is documented as technique T1213 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into SIEM telemetry.”
Adversaries treat a SharePoint site, Confluence space, internal wiki, git repo, or CRM as a searchable index of the things they still need. The prize is rarely the document itself, it is what the document leaks: a service-account password pasted into a runbook, a VPN gateway and shared secret in an onboarding page, an API key or connection string committed to source, a network diagram of the crown-jewel segments, or a customer table in the CRM. Because a repository is where staff write things down so they do not have to remember them, it holds exactly the operational secrets an intruder would otherwise have to phish or crack.
Collection happens two ways. A careful operator browses interactively, running keyword searches like password, vpn, or a project codename and reading the top hits, which is indistinguishable from an employee onboarding onto a new team. A greedier one scripts it: PnP.PowerShell, Graph API clients, or a repository full-data-export walk every site and pull matching files in bulk. The scripted path moves faster and leaves a clear tell, a burst of search and download events under one non-human user-agent.
Either way there is almost nothing on the endpoint to catch. Nothing is dropped on a host, no process is spawned, no vulnerability is touched. It is an authorised account reading an application it is allowed to read, so EDR stays quiet. The signal lives in the cloud audit log instead: the search terms, the volume against that user's baseline, and the client identity behind the requests.
T1213 is a mid-chain move. An intruder first needs to be inside as a believable identity, usually through Valid Accounts (T1078) or freshly stolen credentials, and only then turns that access on the knowledge base to work out what to take and where to pivot next. What it feeds is exfiltration: the files and records surfaced here leave over the same sanctioned channel via Exfiltration Over Web Service (T1567), or get pulled straight from the cloud store with Transfer Data to Cloud Account (T1537).
Google Threat Intelligence tracked ShinyHunters-branded operations that phish SSO credentials by voice and then steal data directly from victims' cloud SaaS applications, which is T1213 at scale against a SaaS repository. The Splunk detection shipped with this page ties the same SharePoint sensitive-term search pattern to Akira, Scattered Spider, and Volt Typhoon, crews known to comb internal repositories for credentials and network detail before pushing deeper into a network.
The following detection strategies help SOC analysts identify Data from Information Repositories activity. These methods apply across SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
web where event.dataset == "o365.audit" and event.provider == "SharePoint"
and event.action == "SearchQueryPerformed" and event.outcome == "success"
and o365.audit.SearchQueryText like~ (
"*password*", "*credential*", "*secret*", "*api key*", "*private key*",
"*confidential*", "*ssn*", "*vpn*", "*network diagram*", "*database*", "*backup*"
)Elastic's production o365 rule: a user searching SharePoint/OneDrive for sensitive terms in the M365 Unified Audit Log. This is the core signal: legitimate access that betrays intent through what it searches for.
index=o365 Workload=SharePoint Operation=SearchQueryPerformed SearchQueryText=*
| eval user=lower(UserId), src=ClientIP
| bin _time span=1h
| stats dc(SearchQueryText) as distinct_searches, values(SearchQueryText) as searches
by user, src, _time
| where distinct_searches > 20Volume-based companion: a single user running an unusually high number of distinct SharePoint searches in an hour. Splunk Security Content ties this pattern to Akira, Scattered Spider and Volt Typhoon. Tune the threshold to your baseline.
{
"CreationTime": "2026-07-14T03:14:22",
"Operation": "SearchQueryPerformed",
"Workload": "SharePoint",
"ClientIP": "203.0.113.44",
"UserId": "j.martinez@corp.com",
"SiteUrl": "https://corp.sharepoint.com/sites/ITOps",
"SearchQueryText": "domain admin password reset procedure",
"UserAgent": "PnP.PowerShell/2.4.0"
}The behaviour that catches an attacker also describes people doing their jobs. A security engineer or a DLP scanner searches SharePoint for password and secret on purpose, because finding those exposures first is the whole point of the exercise. Admins and power users run genuinely large bulk operations: site migrations, tenant reorganisations, content audits. Sanctioned automation runs PnP.PowerShell and Graph clients on a schedule, so the non-human user-agent that looks damning on an attacker is routine for a service account.
So do not alert on a single sensitive-term search, it will bury you in tickets. Baseline search and download volume per user so a spike is judged against that person's own normal, not a global threshold. Allow-list the service accounts, app IDs, and source IPs you already know run automation and migration jobs. Then weight the detection on the combination: sensitive terms and a volume spike and an unfamiliar IP and an account already flagged risky. Any one of those alone is noise. Together they are a lead worth working.
These realistic alert examples show what Data from Information Repositories looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
The M365 audit log shows j.martinez@corp.com running SharePoint SearchQueryPerformed events for 'domain admin password reset procedure' and 'vpn config' via a PnP.PowerShell user-agent. Scripted searching for credential terms is collection intent, not normal browsing.
A single account performed 60 distinct SharePoint searches in one hour from an unfamiliar client IP, far above its baseline of a handful per day. The volume and IP change indicate programmatic data mining of the information repository.
A Bitbucket audit event recorded an 'Unauthorized full data export triggered' on the payment-service repository, followed by an outside-collaborator addition. Bulk export of a source repository is direct collection of code and embedded secrets.
Start with identity and context. Whose account fired this, and do the client IP and user-agent match how that person or service normally works? Check whether the account is already flagged: impossible travel, a recent password reset, a phishing hit, a burst of MFA prompts. Then read the audit trail for intent. What terms were searched, which sites were hit, and what was actually downloaded or exported rather than only viewed?
A scripted sensitive-term sweep from an unfamiliar IP against an account carrying any prior compromise signal is active Collection in progress. Escalate it, do not close it as noise. Contain by revoking the account's active sessions and refresh tokens and forcing re-authentication, which kills a stolen-token operation on the spot. Then scope it: pull the full list of items that account accessed and exported, and bring in the data owner to judge whether what left is sensitive enough to trigger breach handling.
Investigate Data from Information Repositories on realistic SIEM, XDR, and firewall consoles, free.
Data exfiltration is the unauthorized transfer of sensitive data out of a victim environment to attacker-controlled infr…
Read more GlossaryData Loss Prevention (DLP) is a set of technologies and policies that detect and prevent unauthorized transmission, stor…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more GlossaryLog management is the process of collecting, normalizing, storing, retaining, and analyzing log data from across the IT …
Read more Career PathDFIR Analysts combine forensic investigation with incident response. You collect and analyze digital evidence from compr…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogArticles on SOC analyst skills, detection engineering, and career development.
Read more