Techniques › T1213.003 › AN0732
AN0732 Analytic 0732
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Anomalous or bulk download activity from private or restricted repositories by non-developer or privileged accounts, often preceded by unusual login behavior (e.g., unfamiliar geo, OAuth token use, elevated API rate).</p>
- Detects
- T1213.003 Code Repositories
- Part of
- DET0263 Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:github | repo.download, repo.clone, oauth.authorize, repo.getContent | DC0070 Cloud Service Metadata |
| saas:github | Login from unusual IP, device fingerprint, or location; access token creation from new client | DC0067 Logon Session Creation |
| saas:github | Bulk access to multiple files or large volume of repo requests within short time window | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Threshold for file access volume over short duration (e.g., 10+ repos accessed in <5 min) |
UserContext | Role or permission profile expected to interact with repositories (e.g., developers vs. admins) |
GeoAnomalyThreshold | Distance or variance allowed before a login is flagged as anomalous |
RepoSensitivityTag | Whether a repository is labeled sensitive or restricted |