H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources

14 recorded

Relationships

mitigates
from Audit
Mitigation
mitigatesMitigation
mitigatesMitigation
subtechnique-ofTechnique
uses
from Akira
Group
uses
from APT28
Group
uses
from C0027
Campaign
uses
from Chimera
Group
uses
from HAFNIUM
Group
usesGroup
uses
from LAPSUS$
Group
usesTool
usesTool
usesGroup
2 external

References

mitre-attack
T1213.002
open
Microsoft SharePoint Logging
https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2
open