Techniques › T1213 › T1213.006

T1213.006 Databases

collection — IaaS, Linux, macOS, SaaS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0242 Suspicious Database Access and Dump Activity Across Environments (T1213.006) v1.0
  AN0676 Linux

  Unusual database command-line access (e.g., psql, mysql, mongo) from non-admin users, occurring outside typical automation windows or without known service context. Often followed by data dumps to .sql/.csv files or outbound data transfers. Defender sees CLI tools launched interactively or by unusual parent processes, file writes to dump-like filenames, and external connections shortly after.

  auditd:SYSCALL execve: Execution of CLI tools like psql, mysql, mongo, sqlite3 → DC0032 Process Creation

  auditd:PATH Creation of files with extensions .sql, .csv, .sqlite, especially in user directories → DC0039 File Creation

  NSM:Flow http::post: Outbound HTTP POST from host shortly after DB export activity → DC0085 Network Traffic Content

  Tunable: AllowedDBClients DumpFilePattern TimeWindow
  AN0677 Windows

  Database client execution (e.g., sqlcmd.exe, isql.exe) by users or from locations not tied to enterprise automation or backups. Often followed by creation of .sql/.bak/.csv files, registry artifacts for ODBC/JDBC drivers, or encrypted ZIPs. Defender sees SQL tools launched by explorer.exe, Powershell, or odd parent processes, plus file writes in user temp locations.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: KnownDBToolPaths ExportExtensionPatterns MaxTransferVolume
  AN0678 macOS

  Execution of Java-based or CLI database tools (e.g., DBeaver, Beekeeper, mysql, psql) from user profiles not tied to dev/admin roles, especially when followed by file writes and cloud sync activity. Defender correlates GUI tool launches, file write events in ~/Downloads or ~/Documents, and outbound API calls to known cloud services.

  macos:unifiedlog Process start of Java or native DB client tools → DC0032 Process Creation

  macos:unifiedlog Writes of .sql/.csv/.xlsx files to user documents/downloads → DC0039 File Creation

  NSM:Flow HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage → DC0085 Network Traffic Content

  Tunable: CloudSyncDomainList UserPrivilegeLevel
  AN0679 IaaS

  Database enumeration and export activity (e.g., SELECT * FROM, SHOW DATABASES) issued via ephemeral VMs, admin APIs, or cloud shell from non-monitoring accounts. Defender correlates audit logs (CloudTrail, GCP Admin, AzureDiagnostics), storage write ops, and cross-region transfers by identities not tied to DB operations.

  AWS:CloudTrail rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context → DC0070 Cloud Service Metadata

  AWS:CloudTrail PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access → DC0025 Cloud Storage Access

  AWS:VPCFlowLogs Large transfer volume (>20MB) from RDS IP range to external public IPs → DC0082 Network Connection Creation

  Tunable: IAMAccessPatterns S3ExportThreshold DBQueryVerbosityThreshold
  AN0680 SaaS

  Unusual or excessive database/table exports from SaaS database platforms (e.g., Snowflake, Firebase, BigQuery, Airtable) by users or apps not in known analytics or dev groups. Defender observes access patterns outside baseline working hours or with new query templates, and correlates those with audit logs or file downloads.

  saas:Snowflake QUERY: Large or repeated SELECT * queries to sensitive tables → DC0038 Application Log Content

  m365:unified Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365) → DC0055 File Access

  Tunable: BaselineQueryTemplates OffHoursAccessWindow

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1213.006

Rules tagged at the parent level (attack.t1213) 7

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.