TA0009 · COLLECTION
Sharepoint
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems.
Detect it with
The user access logging within Microsoft's SharePoint can be configured to report access to certain pages and documents. .
Why it matters on shift
Sharepoint is one of the concrete ways adversaries achieve collection. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After collection, the next tactic is usually Command and Control. Search your telemetry for the transition before closing the ticket.
Kill-chain context