Detecting and Mitigating SharePoint Data Mining (T1213.002)

SharePoint (MITRE ATT&CK T1213.002) is a sub-technique of data from information repositories. The adversary uses SharePoint as a source of valuable information. MITRE files it under Collection and lists Office Suite and Windows.

How attackers use it

SharePoint often has information that teaches an attacker about the structure and function of internal networks and systems. MITRE lists the kinds of content: policies and procedures, network diagrams, system architecture diagrams, technical documentation, test and development credentials, project schedules, source code snippets, and links to network shares and other internal resources.

The MITRE page lists several actors who accessed or downloaded SharePoint content, abused compromised credentials to pull data out, or used an enumeration tool. One example describes an actor who searched SharePoint for VPN and MFA enrollment information, help desk instructions and new hire guides. That kind of content helps with social engineering as much as with technical access.

How to detect it

MITRE's detection strategy is privileged or rarely used accounts doing bulk access to SharePoint files or metadata over a short time, which suggests scripted collection of internal documents.

Turn on the unified audit log for SharePoint, keep it long enough to investigate, and alert on file download and access spikes from a single account, on first-time access to many sites, and on access from new networks or devices. Pay attention to administrator and service accounts, which rarely browse documents.

How to reduce the risk

MITRE's mitigations:

• Audit accounts and privileges for critical and sensitive SharePoint repositories.
• Apply least privilege, with authentication and authorization controls.
• Publish a policy on what information may be stored in SharePoint.

Also look at sharing settings. Sites and libraries open to everyone in the organization, or links that anyone can use, widen what a single stolen account can read.

Quick check

Sources

• MITRE ATT&CK T1213.002: Sharepoint