Data from Information Repositories: Messaging Applications (T1213.005)

Tactic: Collection · Platforms: Office Suite, SaaS

The interactive view maps 1 detection strategy, 3 mitigations, 3 threat groups, 1 software entry to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Data from Information Repositories (T1213).

Overview

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:

* Testing / development credentials (i.e., Chat Messages) * Source code snippets * Links to network shares and other internal resources * Proprietary data * Discussions about ongoing incident response efforts

In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.

Explore

• Open T1213.005 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1213.005
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan