T1213.005_messaging-applications

T1213.005 Messaging Applications

Sub-technique of: T1213

High-Level Description

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:

• Testing / development credentials (i.e., Chat Messages)
• Source code snippets
• Links to network shares and other internal resources
• Proprietary data
• Discussions about ongoing incident response efforts

In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.

Kill Chain Phase

• Collection (TA0009)

Platforms: SaaS, Office Suite

What to Check

• Identify if Messaging Applications technique is applicable to target environment
• Check SaaS systems for indicators of Messaging Applications
• Check Office Suite systems for indicators of Messaging Applications
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Messaging Applications by examining the target platforms (SaaS, Office Suite).

2. Assess Existing Defenses: Review whether mitigations for T1213.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1017 User Training

Develop and publish policies that define acceptable information to be posted in chat applications.

M1047 Audit

Preemptively search through communication services to find inappropriately shared data, and take actions to reduce exposure when found.

M1060 Out-of-Band Communications Channel

Implement secure out-of-band communication channels to use as an alternative to in-network chat applications during a security incident. This ensures that critical communications remain secure even if primary messaging channels are compromised by adversaries.

Detection

Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments

Risk Assessment

CWE Categories

References

• Sentinel Labs NullBulge 2024
• Permiso Scattered Spider 2023
• SC Magazine Ragnar Locker 2021
• Guardian Grand Theft Auto Leak 2022
• Microsoft DEV-0537
• Atomic Red Team - T1213.005
• MITRE ATT&CK - T1213.005