Techniques › T1213.006 › AN0679
AN0679 Analytic 0679
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Database enumeration and export activity (e.g.,
SELECT * FROM, SHOW DATABASES) issued via ephemeral VMs, admin APIs, or cloud shell from non-monitoring accounts. Defender correlates audit logs (CloudTrail, GCP Admin, AzureDiagnostics), storage write ops, and cross-region transfers by identities not tied to DB operations.</p>- Detects
- T1213.006 Databases
- Part of
- DET0242 Suspicious Database Access and Dump Activity Across Environments (T1213.006)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context | DC0070 Cloud Service Metadata |
| AWS:CloudTrail | PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access | DC0025 Cloud Storage Access |
| AWS:VPCFlowLogs | Large transfer volume (>20MB) from RDS IP range to external public IPs | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
IAMAccessPatterns | Define which IAM roles/accounts are allowed DB operations |
S3ExportThreshold | Size threshold (MB) or file pattern for S3-based exfil monitoring |
DBQueryVerbosityThreshold | Number of rows/columns or duration to flag long-running queries |