{"id":"T1213.002","name":"Sharepoint","url":"https://attack.mitre.org/techniques/T1213/002","tactics":["collection"],"platforms":["Office Suite","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0500","stix_id":"x-mitre-detection-strategy--960d6663-6a7f-4f95-affe-a28d71afc7d9","name":"Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users","url":"https://attack.mitre.org/detectionstrategies/DET0500","analytics":[{"id":"AN1380","stix_id":"x-mitre-analytic--afb1860a-e29a-4ce8-9524-ab371c5f8d4f","name":"Analytic 1380","description":"Privileged or rarely used accounts performing bulk access to SharePoint files or metadata over a short time window, indicating potential scripted collection of sensitive internal documents.","url":"https://attack.mitre.org/detectionstrategies/DET0500#AN1380","platforms":["Windows"],"log_source_references":[{"name":"m365:unified","channel":"FileAccessed, FileDownloaded, SearchQueried","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"azure:signinlogs","channel":"UserLogin, ConditionalAccessPolicyEvaluated","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"azure-signinlogs"},{"name":"m365:sharepoint","channel":"Multiple file download operations on a site by a privileged account in a short time window","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"m365-sharepoint"}],"mutable_elements":[{"field":"UserContext","description":"Can be adjusted to focus on specific high-privilege or rarely-used service accounts"},{"field":"TimeWindow","description":"Defines the aggregation period for multiple download events (e.g., 10 minutes)"},{"field":"DownloadThreshold","description":"Minimum number of documents accessed/downloaded to trigger alert"},{"field":"SiteScope","description":"Limit detection to sensitive SharePoint sites such as HR, Finance, Engineering"}],"live":true,"detection_strategies":["DET0500"],"techniques":["T1213.002"]}],"live":true,"version":"1.0","techniques":["T1213.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}