T1213.002 — Sharepoint

Tactic: Collection · Platforms: Office Suite, Windows

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (1)

T1213.002 Data from Information Repositories: Sharepoint

title: "T1213.002 Data from Information Repositories: Sharepoint"
id: 36472775-0c5d-4d5a-be9b-496c71cffb37
description: 'Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: UserContext, TimeWindow, DownloadThreshold, SiteScope.'
references:
  - https://attack.mitre.org/techniques/T1213/002
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.collection
  - attack.t1213.002

logsource:
  product: m365
  service: unified

detection:
  selection:
    Workload: 'SharePoint'
    Operation:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
      - 'FileAccessed'
      - 'SearchQueryPerformed'

  condition: selection

falsepositives:
  - Employees performing legitimate bulk downloads or content migration from SharePoint document libraries.

level: medium

Related sub-techniques

Explore