Detecting and Mitigating Chat App Data Mining (T1213.005)

Chat is where people paste things they should not. MITRE ATT&CK describes mining those messages as T1213.005, Messaging Applications. It falls under Collection and covers Office Suite and SaaS platforms such as Microsoft Teams, Google Chat and Slack.

How attackers use it

MITRE gives a short list of what may be sitting in chat:

• Testing and development credentials
• Source code snippets
• Links to network shares and other internal resources
• Proprietary data
• Discussions about ongoing incident response

Beyond taking the data, adversaries can use chat to improve their targeting, for example by learning more about the environment or by watching your response so they can evade it.

How to detect it

The MITRE detection strategy for this technique points at atypical access to Slack or Teams conversations through APIs, automation tokens or bulk export features, particularly after an account takeover or a rare sign-in pattern. Look for mass retrieval of chat history, downloads of message content, and scraping of workspace or channel metadata.

For Teams specifically, MITRE calls out access to chat messages through eDiscovery, the Graph API or export methods after a rare or compromised sign-in, often alongside excessive file access.

How to reduce the risk

• Publish a policy that defines what may be posted in chat applications.
• Search your communication services ahead of time for data that was shared where it should not have been, then reduce the exposure when you find it.
• Set up an out-of-band communication channel for incidents, so critical conversations stay private even if the primary chat is compromised.

The first two steps also pair well with secrets scanning. A credential pasted into chat is still a credential, and it should be rotated like any other leaked secret.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, T1213.005: https://attack.mitre.org/techniques/T1213/005