cyberstrikeus T1213.005 Messaging Applications
Sub-technique of: T1213
High-Level Description
Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:
- Testing / development credentials (i.e., Chat Messages)
- Source code snippets
- Links to network shares and other internal resources
- Proprietary data
- Discussions about ongoing incident response efforts
In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.
Kill Chain Phase
- Collection (TA0009)
Platforms: SaaS, Office Suite
What to Check
- Identify if Messaging Applications technique is applicable to target environment
- Check SaaS systems for indicators of Messaging Applications
- Check Office Suite systems for indicators of Messaging Applications
- Verify mitigations are bypassed or absent (3 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Messaging Applications by examining the target platforms (SaaS, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1213.005 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1017 User Training
Develop and publish policies that define acceptable information to be posted in chat applications.
M1047 Audit
Preemptively search through communication services to find inappropriately shared data, and take actions to reduce exposure when found.
M1060 Out-of-Band Communications Channel
Implement secure out-of-band communication channels to use as an alternative to in-network chat applications during a security incident. This ensures that critical communications remain secure even if primary messaging channels are compromised by adversaries.
Detection
Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Messaging Applications technique applicable | High | Collection |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |