T1213.001 Confluence
Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
- Policies, procedures, and standards
- Physical / logical network diagrams
- System architecture diagrams
- Technical system documentation
- Testing / development credentials
- Work / project schedules
- Source code snippets
- Links to network shares and other internal resources
Procedure Examples
| ID |
Name |
Description |
| G1004 |
LAPSUS$ |
LAPSUS$ has searched a victim’s network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials. |
Mitigations
| ID |
Mitigation |
Description |
| M1047 |
Audit |
Consider periodic review of accounts and privileges for critical and sensitive Confluence repositories. |
| M1018 |
User Account Management |
Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization. |
| M1017 |
User Training |
Develop and publish policies that define acceptable information to be stored in Confluence repositories. |
Detection
References