T1213.003 — Code Repositories

Tactic: Collection · Platforms: SaaS

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (1)

T1213.003 Data from Information Repositories: Code Repositories

title: "T1213.003 Data from Information Repositories: Code Repositories"
id: b25e738c-71bd-4c74-9699-66b58254a6c4
description: 'Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms. (Data Component: Cloud Service Metadata; baseline tier: fallback.) Tune using: TimeWindow, UserContext, GeoAnomalyThreshold, RepoSensitivityTag.'
references:
  - https://attack.mitre.org/techniques/T1213/003
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.collection
  - attack.t1213.003

logsource:
  product: saas
  service: github

detection:
  selection_clone:
    action: 'git.clone'
  selection_private_repo_add:
    action:
      - 'repo.access'
      - 'repo.add_member'
  filter_known_ci:
    actor|contains:
      - 'github-actions'
      - 'dependabot'

  condition: (selection_clone or selection_private_repo_add) and not filter_known_ci

falsepositives:
  - Normal developer clone activity or automated CI runners fetching repository contents as part of a build.

level: medium

Related sub-techniques

Explore