Confluence (MITRE ATT&CK T1213.001) is a sub-technique of data from information repositories. The adversary mines Confluence for valuable information. MITRE files it under Collection and lists SaaS.
How attackers use it
Confluence is often found in development environments next to Jira, and is generally used for development documentation. MITRE lists what it can hold: policies, procedures and standards, network diagrams, system architecture diagrams, technical documentation, test and development credentials, project schedules, source code snippets, and links to network shares and other internal resources.
The MITRE page lists an actor that searched a victim network for collaboration platforms such as Confluence and Jira to find more high-privilege credentials, and a tool that collected credentials and data tied to Confluence.
How to detect it
MITRE's detection strategy is excessive or programmatic access to Confluence spaces or pages, especially by privileged users. Combine access logs, API usage and identity context: logon sessions, user roles and abnormal document viewing or export behavior. Look for burst access patterns and for scripts or tools that use the Confluence API for mass enumeration or scraping.
In practice, baseline how many pages a typical user opens, then alert on an account that opens or exports far more than that, or that reads through the API from a new network.
How to reduce the risk
MITRE's mitigations:
- Audit accounts and privileges for critical and sensitive Confluence spaces on a regular schedule.
- Apply least privilege, with access control covering authentication and authorization.
- Publish a policy on what may be stored in Confluence.
Search your own spaces for words such as password and token. Pages that hold credentials are the first to move into a secrets manager.
Quick check
What access pattern does the detection strategy flag?
Excessive or programmatic access, such as bursts of page views or API-driven enumeration and scraping, particularly by privileged users.
