MITRE ATT&CKsub-technique

T1213.006 Databases

Published 2025-05-22 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
IaaS, Linux, macOS, SaaS, Windows
Version
1.0
Created
2025-05-22

Description

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for Lateral Movement, Command and Control, or Exfiltration. Data exfiltrated from databases may also be used to extort victims or may be sold for profit.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1213 Data from Information Repositories technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (5)

  • M1054 Software Configuration mitigation
  • M1041 Encrypt Sensitive Information mitigation
  • M1047 Audit mitigation
  • M1017 User Training mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (14)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • G1057 ShinyHunters group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • S9010 GlassWorm software (malware)
  • C0049 Leviathan Australian Intrusions campaign
  • G1041 Sea Turtle group
  • C0040 APT41 DUST campaign
  • S1146 MgBot software (malware)
  • S0598 P.A.S. Webshell software (malware)
  • G0082 APT38 group
  • G0010 Turla group
  • G0034 Sandworm Team group
  • G0037 FIN6 group

Referenced by Compliance · mitigates (2)

  • CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1

References