LAPSUS$G1004 ↗
Has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.1
- Tactic
- Credential Access
- Platforms
- SaaS, Office Suite
- Version
- 1.1
- Created
- 14 March 2023
- Last modified
- 15 April 2025
- Contributor
- Douglas Weir
Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Chat Messages MITRE reference T1552.008
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
Offense vs defense T1552.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Chat Messages detection strategy DET0111
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Unsecured Credentials Shared in Chat Messages
2 platforms
AN0309 · Office Suite
Detection correlates message events in email and collaboration tools (e.g., Outlook, Teams) that contain regex-like patterns resembling credentials, API keys, or tokens. Anomalous forwarding or bulk copy activity of chat/email content containing secrets is flagged. Suspicious behavior includes users pasting secrets into direct messages or attaching config files with passwords.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | MessageSend, MessageRead, or FileAttached events containing credential-like patterns |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RegexPatterns | Customizable credential-detection regex (e.g., API_KEY=, bearer token formats) depending on enterprise apps in use |
| AllowedDomains | Exclude known trusted domains or automated system-to-system messages |
| TimeWindow | Adjust correlation period for bulk credential sharing events |
AN0310 · SaaS
Detection monitors SaaS collaboration tools (e.g., Slack, Zoom, Jira) for messages or files containing credential-like patterns, or for suspicious API calls retrieving bulk chat histories by non-admin users. Identifies adversary behavior chains where chat logs are queried via APIs or integration bots to systematically extract sensitive material.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | saas:okta | Unusual OAuth app requesting message-read scopes for Slack/Teams/Jira |
| Application Log ContentDC0038 | saas:slack | chat.postMessage, files.upload, or discovery API calls involving token/credential regex |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| IntegrationScope | Tune to ignore known enterprise bots with message-read access (e.g., DLP scanners) |
| RegexPatterns | Customizable regex for detecting secret formats (JWT, OAuth tokens, SSH keys) |
| UserContext | Correlate with user role to filter developers vs standard users |
AuditM1047
Preemptively search through communication services to find shared unsecured credentials. Searching for common patterns like "password is ", “password=” and take actions to reduce exposure when found.
User TrainingM1017
Ensure that developers and system administrators are aware of the risk associated with sharing unsecured passwords across communication services.