| ID | Name |
|---|---|
| T1213.001 | Confluence |
| T1213.002 | Sharepoint |
| T1213.003 | Code Repositories |
| T1213.004 | Customer Relationship Management Software |
| T1213.005 | Messaging Applications |
| T1213.006 | Databases |
Adversaries may leverage the SharePoint repository as a source to mine valuable information.[1] SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
| ID | Name | Description |
|---|---|---|
| G1024 | Akira |
Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.[2] |
| G0007 | APT28 |
APT28 has collected information from Microsoft SharePoint services within target networks.[3] |
| C0027 | C0027 |
During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.[4] |
| G0114 | Chimera |
Chimera has collected documents from the victim's SharePoint.[5] |
| G0125 | HAFNIUM |
HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.[6] |
| G0004 | Ke3chang |
Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.[7] |
| G1004 | LAPSUS$ |
LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.[8][9] |
| G1059 | NIMBUS MANTICORE |
NIMBUS MANTICORE has downloaded files from SharePoint services.[10] |
| S0227 | spwebmember |
spwebmember is used to enumerate and dump information from Microsoft SharePoint.[7] |
| S9009 | TruffleHog |
TruffleHog has searched SharePoint for data and credentials.[11] |
| G1055 | VOID MANTICORE |
VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.[12] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Consider periodic review of accounts and privileges for critical and sensitive SharePoint repositories. |
| M1018 | User Account Management |
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization. |
| M1017 | User Training |
Develop and publish policies that define acceptable information to be stored in SharePoint repositories. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0500 | Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users | AN1380 |
Privileged or rarely used accounts performing bulk access to SharePoint files or metadata over a short time window, indicating potential scripted collection of sensitive internal documents. |