Scattered SpiderG1015 ↗
Threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.1
tfMITRE ATT&CK sub-technique
Messaging Applications T1213.005
sub-technique of T1213 Data from Information Repositories
- Tactic
- Collection
- Platforms
- Office Suite, SaaS
- Version
- 1.0
- Created
- 30 August 2024
- Last modified
- 12 May 2026
- Contributors
- Menachem Goldstein; Obsidian Security
Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Messaging Applications MITRE reference T1213.005
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LAPSUS$G1004 ↗
Has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.1
Fox KittenG0117 ↗
Has accessed victim security and IT environments and Microsoft Teams to mine valuable information.1
All 3 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TruffleHogS9009 ↗
Has obtained data and credentials associated with messaging applications to include Slack.1
All 1 software entries for this technique
Offense vs defense T1213.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Messaging Applications detection strategy DET0567
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments
2 platforms
AN1565 · SaaS
Atypical access to Slack or Teams conversations via APIs, automation tokens, or bulk message export functionality, particularly after an account takeover or rare sign-in pattern. Often includes mass retrieval of chat history, download of message content, or scraping of workspace/channel metadata.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:slack | conversations.history, files.list, users.info, audit_logs |
| Logon Session CreationDC0067 | m365:signinlogs | UserLoggedIn |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time interval to observe post-login message scraping behavior |
| MessageExportThreshold | Number of messages or files accessed/downloaded to flag for review |
| UserContext | User privilege level, team membership, or role context to suppress false positives |
| AccessMethod | Direct user access vs API token, OAuth app, or bot interaction |
AN1566 · Office Suite
Suspicious access to Microsoft Teams chat messages via eDiscovery, Graph API, or export methods after rare or compromised sign-in. Often associated with excessive file access, sensitive content review, or anomaly from expected user behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport |
| Logon Session CreationDC0067 | m365:signinlogs | UserLoggedIn |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserRole | Whether user is part of InfoSec, Legal, or expected to use Teams eDiscovery tools |
| GeoRiskScore | Unusual country/IP sign-in patterns prior to Teams data export |
| AccessVolume | Message or file threshold for triggering alert |
AuditM1047
Preemptively search through communication services to find inappropriately shared data, and take actions to reduce exposure when found.
Implement secure out-of-band communication channels to use as an alternative to in-network chat applications during a security incident. This ensures that critical communications remain secure even if primary messaging channels are compromised by adversaries.
User TrainingM1017
Develop and publish policies that define acceptable information to be posted in chat applications.