T1213.006 — Databases

Tactic: Collection · Platforms: IaaS, Linux, macOS, SaaS, Windows

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB,…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (5)

title: "T1213.006 Data from Information Repositories: Databases"
id: e5aa6970-655b-4456-8308-6a6efb2e078d
description: 'Detects execution of database dump/export utilities (mysqldump, pg_dump, mongodump, bcp) or export-oriented SQL/CLI syntax consistent with bulk collection from a database repository (T1213.006). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: KnownDBToolPaths, ExportExtensionPatterns, AllowedServiceAccounts.'
references:
  - https://attack.mitre.org/techniques/T1213/006
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.collection
  - attack.t1213.006

logsource:
  category: process_creation
  product: windows

detection:
  selection_dump_tools:
    Image|endswith:
      - '\mysqldump.exe'
      - '\pg_dump.exe'
      - '\pg_dumpall.exe'
      - '\mongodump.exe'
      - '\bcp.exe'
  selection_export_cli:
    CommandLine|contains:
      - 'SELECT * INTO OUTFILE'
      - 'BACKUP DATABASE'
      - 'mongoexport'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_dump_tools or selection_export_cli) and not filter_system_account

falsepositives:
  - Scheduled/automated database backup jobs using the same utilities; DBA-run maintenance exports.

level: medium

title: "T1213.006 Data from Information Repositories: Databases"
id: f2285c2d-4081-4647-a6b5-b1c570280c21
description: 'Suspicious Database Access and Dump Activity Across Environments (T1213.006). The prior version required a1 to contain ">" to detect output redirection, but shell redirection operators are parsed and consumed by the invoking shell before exec — they never appear in the argv auditd captures for the executed mysqldump, pg_dump, or mongodump process itself, so that condition could not match real dump activity. This version drops the invalid redirection check and instead alerts on execution of the database-dump utilities themselves; combine with a follow-up file-creation (PATH record) or network-egress event downstream to further reduce noise from routine backups. Tune using: AllowedDBClients, DumpFilePattern, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1213/006
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.collection
  - attack.t1213.006

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/mysqldump'
      - '/pg_dump'
      - '/mongodump'

  condition: selection

falsepositives:
  - Routine, scheduled database backups performed by admins/cron/backup-automation accounts; scope AllowedDBClients to the backup service account and DumpFilePattern to the expected backup destination path to reduce noise from this now-broader (but functionally correct) match.

level: medium

title: "T1213.006 Data from Information Repositories: Databases"
id: c9327e2c-8907-4895-bc70-111b7e4fb28b
description: 'Suspicious Database Access and Dump Activity Across Environments (T1213.006). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CloudSyncDomainList, UserPrivilegeLevel.'
references:
  - https://attack.mitre.org/techniques/T1213/006
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.collection
  - attack.t1213.006

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bird'
      - '/fileproviderd'
    CommandLine|contains:
      - 'iCloudDrive'
      - 'com.apple.CloudDocs'
  condition: selection

falsepositives:
  - The iCloud and third party cloud sync daemons run continuously on nearly every macOS host, so this only becomes meaningful when correlated with bulk staging of unusual document types, which is not visible from process creation telemetry alone.

level: medium

title: "T1213.006 Data from Information Repositories: Databases"
id: 761fffab-9c66-4d4e-92fe-ba86d23df73e
description: 'Detects invocation of database dump/export utilities (mysqldump, pg_dump, mongodump, sqlite3 .dump, redis-cli save/bgsave/--rdb) via auditd EXECVE records, rather than merely observing any client connect() to a database port - the prior logic fired on routine, benign application queries with no differentiation for bulk export/mining behavior. Tune using: IAMAccessPatterns, S3ExportThreshold, DBQueryVerbosityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1213/006
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.collection
  - attack.t1213.006

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_dump_tools:
    type: EXECVE
    a0|endswith:
      - '/mysqldump'
      - '/pg_dump'
      - '/pg_dumpall'
      - '/mongodump'
      - '/sqlite3'
  selection_redis_dump:
    type: EXECVE
    a0|endswith: '/redis-cli'
    a1:
      - '--rdb'
      - 'save'
      - 'bgsave'

  condition: 1 of selection_*

falsepositives:
  - Scheduled backup jobs and database administrators routinely invoke these same dump utilities; correlate with off-hours timing, an unusual invoking user, or an unexpected destination path/host for higher confidence.

level: medium

title: "T1213.006 Data from Information Repositories: Databases"
id: d24cce0b-2f19-424c-91f9-40fb71aae8e8
description: 'Suspicious Database Access and Dump Activity Across Environments (T1213.006). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: BaselineQueryTemplates, OffHoursAccessWindow.'
references:
  - https://attack.mitre.org/techniques/T1213/006
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.collection
  - attack.t1213.006

logsource:
  product: saas
  service: snowflake

detection:
  selection_bulk_select:
    QUERY_TYPE: 'SELECT'
    EXECUTION_STATUS: 'SUCCESS'
  filter_low_rows:
    ROWS_PRODUCED|lte: 1000

  condition: selection_bulk_select and not filter_low_rows

falsepositives:
  - Legitimate analytics or BI-tool queries that return large result sets as part of scheduled reporting jobs; a query-template baseline is needed to reliably separate this from data staging.

level: medium

Related sub-techniques

• T1213.004 Customer Relationship Management Software
• T1213.001 Confluence
• T1213.003 Code Repositories
• T1213.005 Messaging Applications
• T1213.002 Sharepoint

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1213.006 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan