| ID | Name |
|---|---|
| T1213.001 | Confluence |
| T1213.002 | Sharepoint |
| T1213.003 | Code Repositories |
| T1213.004 | Customer Relationship Management Software |
| T1213.005 | Messaging Applications |
| T1213.006 | Databases |
Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:
In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.[4][5]
| ID | Name | Description |
|---|---|---|
| G0117 | Fox Kitten |
Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.[6] |
| G1004 | LAPSUS$ |
LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.[7] |
| G1015 | Scattered Spider |
Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.[8] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Preemptively search through communication services to find inappropriately shared data, and take actions to reduce exposure when found. |
| M1060 | Out-of-Band Communications Channel |
Implement secure out-of-band communication channels to use as an alternative to in-network chat applications during a security incident. This ensures that critical communications remain secure even if primary messaging channels are compromised by adversaries.[9] |
| M1017 | User Training |
Develop and publish policies that define acceptable information to be posted in chat applications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0567 | Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments | AN1565 |
Atypical access to Slack or Teams conversations via APIs, automation tokens, or bulk message export functionality, particularly after an account takeover or rare sign-in pattern. Often includes mass retrieval of chat history, download of message content, or scraping of workspace/channel metadata. |
| AN1566 |
Suspicious access to Microsoft Teams chat messages via eDiscovery, Graph API, or export methods after rare or compromised sign-in. Often associated with excessive file access, sensitive content review, or anomaly from expected user behavior. |