MITRE ATT&CKsub-technique

T1213.005 Messaging Applications

Published 2024-08-30 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Office Suite, SaaS
Version
1.0
Created
2024-08-30

Description

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: • Testing / development credentials (i.e., Chat Messages) • Source code snippets • Links to network shares and other internal resources • Proprietary data • Discussions about ongoing incident response efforts In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1213 Data from Information Repositories technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1060 Out-of-Band Communications Channel mitigation
  • M1047 Audit mitigation
  • M1017 User Training mitigation

Referenced by MITRE ATT&CK · uses (6)

Referenced by Compliance · mitigates (24)

  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-21 Information Sharing NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References