{"id":"T1213.006","name":"Databases","url":"https://attack.mitre.org/techniques/T1213/006","tactics":["collection"],"platforms":["IaaS","Linux","macOS","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0242","stix_id":"x-mitre-detection-strategy--18fe3660-c079-4522-b1d7-7ce7f65f9686","name":"Suspicious Database Access and Dump Activity Across Environments (T1213.006)","url":"https://attack.mitre.org/detectionstrategies/DET0242","analytics":[{"id":"AN0676","stix_id":"x-mitre-analytic--147c0305-abff-4bc3-ae2a-acd69d0b87fd","name":"Analytic 0676","description":"Unusual database command-line access (e.g., `psql`, `mysql`, `mongo`) from non-admin users, occurring outside typical automation windows or without known service context. Often followed by data dumps to .sql/.csv files or outbound data transfers. Defender sees CLI tools launched interactively or by unusual parent processes, file writes to dump-like filenames, and external connections shortly after.","url":"https://attack.mitre.org/detectionstrategies/DET0242#AN0676","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: Execution of CLI tools like psql, mysql, mongo, sqlite3","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:PATH","channel":"Creation of files with extensions .sql, .csv, .sqlite, especially in user directories","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-path"},{"name":"NSM:Flow","channel":"http::post: Outbound HTTP POST from host shortly after DB export activity","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"AllowedDBClients","description":"List of user or automation accounts expected to use database clients"},{"field":"DumpFilePattern","description":"Filename patterns used to identify data dumps (e.g., *.sql, backup_*.csv)"},{"field":"TimeWindow","description":"Time threshold for correlating execution, file write, and outbound transfer"}],"live":true,"detection_strategies":["DET0242"],"techniques":["T1213.006"]},{"id":"AN0677","stix_id":"x-mitre-analytic--d869b672-c3e9-446c-9e7a-c9ce5888794c","name":"Analytic 0677","description":"Database client execution (e.g., sqlcmd.exe, isql.exe) by users or from locations not tied to enterprise automation or backups. Often followed by creation of .sql/.bak/.csv files, registry artifacts for ODBC/JDBC drivers, or encrypted ZIPs. Defender sees SQL tools launched by explorer.exe, Powershell, or odd parent processes, plus file writes in user temp locations.","url":"https://attack.mitre.org/detectionstrategies/DET0242#AN0677","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"KnownDBToolPaths","description":"Directories where legitimate database tools are installed"},{"field":"ExportExtensionPatterns","description":"List of file extensions commonly used for DB exports"},{"field":"MaxTransferVolume","description":"Threshold for outbound data volume that may suggest large DB dumps"}],"live":true,"detection_strategies":["DET0242"],"techniques":["T1213.006"]},{"id":"AN0678","stix_id":"x-mitre-analytic--3e87713d-d062-413c-9643-97df331ba651","name":"Analytic 0678","description":"Execution of Java-based or CLI database tools (e.g., DBeaver, Beekeeper, mysql, psql) from user profiles not tied to dev/admin roles, especially when followed by file writes and cloud sync activity. Defender correlates GUI tool launches, file write events in ~/Downloads or ~/Documents, and outbound API calls to known cloud services.","url":"https://attack.mitre.org/detectionstrategies/DET0242#AN0678","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process start of Java or native DB client tools","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Writes of .sql/.csv/.xlsx files to user documents/downloads","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CloudSyncDomainList","description":"FQDNs of sync services used to detect likely outbound DB leakages"},{"field":"UserPrivilegeLevel","description":"Whether to treat low-privilege users accessing DB tools as higher risk"}],"live":true,"detection_strategies":["DET0242"],"techniques":["T1213.006"]},{"id":"AN0679","stix_id":"x-mitre-analytic--041812fa-5446-47cc-8ca0-1106f4874c10","name":"Analytic 0679","description":"Database enumeration and export activity (e.g., `SELECT * FROM`, `SHOW DATABASES`) issued via ephemeral VMs, admin APIs, or cloud shell from non-monitoring accounts. Defender correlates audit logs (CloudTrail, GCP Admin, AzureDiagnostics), storage write ops, and cross-region transfers by identities not tied to DB operations.","url":"https://attack.mitre.org/detectionstrategies/DET0242#AN0679","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access","data_component":"DC0025","data_component_name":"Cloud Storage Access","log_source_slug":"aws-cloudtrail"},{"name":"AWS:VPCFlowLogs","channel":"Large transfer volume (>20MB) from RDS IP range to external public IPs","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"aws-vpcflowlogs"}],"mutable_elements":[{"field":"IAMAccessPatterns","description":"Define which IAM roles/accounts are allowed DB operations"},{"field":"S3ExportThreshold","description":"Size threshold (MB) or file pattern for S3-based exfil monitoring"},{"field":"DBQueryVerbosityThreshold","description":"Number of rows/columns or duration to flag long-running queries"}],"live":true,"detection_strategies":["DET0242"],"techniques":["T1213.006"]},{"id":"AN0680","stix_id":"x-mitre-analytic--544c832f-4849-4fb7-a851-5f69ec0692a9","name":"Analytic 0680","description":"Unusual or excessive database/table exports from SaaS database platforms (e.g., Snowflake, Firebase, BigQuery, Airtable) by users or apps not in known analytics or dev groups. Defender observes access patterns outside baseline working hours or with new query templates, and correlates those with audit logs or file downloads.","url":"https://attack.mitre.org/detectionstrategies/DET0242#AN0680","platforms":["SaaS"],"log_source_references":[{"name":"saas:Snowflake","channel":"QUERY: Large or repeated SELECT * queries to sensitive tables","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-snowflake"},{"name":"m365:unified","channel":"Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365)","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"BaselineQueryTemplates","description":"Query hash or shape for common BI/ETL jobs to reduce false positives"},{"field":"OffHoursAccessWindow","description":"Window to define after-hours activity thresholds for DB access"}],"live":true,"detection_strategies":["DET0242"],"techniques":["T1213.006"]}],"live":true,"version":"1.0","techniques":["T1213.006"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}