{'created': '2025-05-22T19:02:46.718Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may leverage databases to mine valuable '
                'information. These databases may be hosted on-premises or in '
                'the cloud (both in platform-as-a-service and '
                'software-as-a-service environments). \n'
                '\n'
                'Examples of databases from which information may be collected '
                'include MySQL, PostgreSQL, MongoDB, Amazon Relational '
                'Database Service, Azure SQL Database, Google Firebase, and '
                'Snowflake. Databases may include a variety of information of '
                'interest to adversaries, such as usernames, hashed passwords, '
                'personally identifiable information, and financial data. Data '
                'collected from databases may be used for [Lateral '
                'Movement](https://attack.mitre.org/tactics/TA0008), [Command '
                'and Control](https://attack.mitre.org/tactics/TA0011), or '
                '[Exfiltration](https://attack.mitre.org/tactics/TA0010). Data '
                'exfiltrated from databases may also be used to extort victims '
                'or may be sold for profit.(Citation: Google Cloud Threat '
                'Intelligence UNC5537 Snowflake 2024)',
 'external_references': [{'external_id': 'T1213.006',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1213/006'},
                         {'description': 'Mandiant. (2024, June 10). UNC5537 '
                                         'Targets Snowflake Customer Instances '
                                         'for Data Theft and Extortion. '
                                         'Retrieved May 22, 2025.',
                          'source_name': 'Google Cloud Threat Intelligence '
                                         'UNC5537 Snowflake 2024',
                          'url': 'https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion'}],
 'id': 'attack-pattern--248d3fe1-7fe1-4d71-91c7-8bb7ef35cad3',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'collection'}],
 'modified': '2025-10-21T23:54:04.429Z',
 'name': 'Databases',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Linux', 'Windows', 'macOS', 'IaaS', 'SaaS'],
 'x_mitre_version': '1.0'}