T1213.005: Messaging Applications

Messaging applications such as Teams, Google Chat, and Slack can become high-value information repositories, not just communication tools. If an adversary gains access, chat history may expose development credentials, source code snippets, links to internal resources, proprietary data, or live discussions about incident response. The business risk is that routine collaboration data can help an intruder steal information, improve targeting, or understand how defenders are responding.

Executive priority

Treat messaging platforms as part of the sensitive data and incident-response environment. Leaders should ask whether chat data is governed, audited, retained appropriately, and excluded from compromised-network communications during a security incident. This technique matters for resilience and audit readiness because the deciding controls are often basic but under-validated: SaaS audit logging, identity access review, secure out-of-band communications for incidents, and clear rules on sharing credentials or proprietary material in chat.

Technical view

This is a collection sub-technique under Data from Information Repositories for Office Suite and SaaS platforms. SOC and IR teams should validate visibility into messaging application access, searches, downloads/exports, message reads, file access, link access, external sharing, and administrative or API-based activity where available. Detection should align with DET0567, the related detection strategy for unauthorized collection from messaging applications in SaaS and Office environments. Because ATT&CK provides no official detection text for this object, local platform audit capabilities and identity context are critical.

Likely telemetry

SaaS and Office Suite audit logs for messaging platforms
User authentication and session activity, including unusual access patterns
Message, channel, workspace, or chat search activity where logged
File access, download, export, and sharing events associated with chat platforms
Administrative actions, application integrations, and API/token-based access events

Detection direction

Confirm that messaging platform audit logging is enabled and retained long enough for incident response and compliance needs.
Baseline normal user access, search, download, and sharing patterns so bulk or unusual collection can be reviewed without excessive false positives.
Correlate messaging activity with identity signals such as new sessions, anomalous locations, privilege changes, or suspicious OAuth/API use where those logs exist.
Tune detections for sensitive channels, incident-response rooms, engineering discussions, and locations where credentials or source code snippets are more likely to appear.
Review relationship context: ATT&CK links this technique to groups including Fox Kitten, LAPSUS$, and Scattered Spider, and to TruffleHog as software capable of discovering secrets across data sources; use this only as threat-informed context, not proof of local activity.

Mitigation priorities

Apply M1047 Audit: ensure messaging applications produce usable logs and that teams systematically review activity and configuration weaknesses.
Apply M1060 Out-of-Band Communications Channel: maintain a secure communication path for incident response that does not depend on potentially compromised primary chat systems.
Reduce sensitive material in chat by enforcing policy and review around credentials, proprietary data, source code snippets, internal links, and incident details.
Restrict access to sensitive channels and workspaces using least privilege and regular access reviews.
Validate retention, export, and external sharing settings against business, legal, and compliance requirements.

Additional notes and limits

The key defensive question is whether the organization treats collaboration chat as a monitored information repository. For many environments, the largest blind spot is not lack of a detection rule but lack of reliable SaaS audit logs, unclear ownership of chat governance, and use of normal chat rooms during active incident response.

The supplied ATT&CK object has no official detection text. Platform-specific log fields, alert logic, and retention options vary by messaging provider and tenant configuration, so local evidence is required before assessing coverage or residual risk.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Messaging Applications

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques1 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1213	Data from Information Repositories	This object subtechnique of Data from Information Repositories.

Associated objects

Groups, software, and campaigns

G0117: Fox Kitten

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

G1004: LAPSUS$

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]

S9009: TruffleHog

TruffleHog is an open-source secrets-discovery tool that is used to search for credentials, API keys, and encryption keys across a variety of data sources and environments.[1][2] TruffleHog has the ability to discover credentials and secrets stored in code repositories, git history, CI/CD pipelines, among other common storage locations to include filesystems and cloud storage buckets.[1][3][2] TruffleHog was first released by its author in 2016.[2]

IaaSLinuxSaaS

Relationship explorer

All related ATT&CK context

uses · ToolS9009: TruffleHogEnterprise mitigates · MitigationM1017: User TrainingEnterprise mitigates · MitigationM1047: AuditEnterprise uses · GroupG0117: Fox KittenEnterprise subtechnique of · TechniqueT1213: Data from Information RepositoriesEnterprise detects · Detection StrategyDET0567: Detecting Unauthorized Collection from Messaging Applications in SaaS and Office EnvironmentsEnterprise mitigates · MitigationM1060: Out-of-Band Communications ChannelEnterprise uses · GroupG1015: Scattered SpiderEnterprise uses · GroupG1004: LAPSUS$Enterprise

Mitigations

Mitigation direction

M1017: User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures:

Create Comprehensive Training Programs:

- Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting. - Provide role-specific training for high-risk employees, such as helpdesk staff or executives.

Use Simulated Exercises:

- Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training. - Run social engineering drills to evaluate employee responses and reinforce protocols.

Leverage Gamification and Engagement:

- Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.

Incorporate Security Policies into Onboarding:

- Include cybersecurity training as part of the onboarding process for new employees. - Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.

Regular Refresher Courses:

- Update training materials to include emerging threats and techniques used by adversaries. - Ensure all employees complete periodic refresher courses to stay informed.

Emphasize Real-World Scenarios:

- Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering. - Discuss how specific employee actions can prevent or mitigate such attacks.

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

M1060: Out-of-Band Communications Channel

Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication systems. Leveraging these alternative channels reduces the risk of adversaries intercepting, disrupting, or tampering with sensitive communications and helps coordinate an effective incident response.[1][2]

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.0
Created: Aug 30, 2024, 13:50 UTC (UTC+00:00)
Modified: May 12, 2026, 15:12 UTC (UTC+00:00)
Raw hash: 4a5aa779614bd4a6...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	May 12, 2026, 15:12 UTC (UTC+00:00)	Current bundle	`4a5aa779614b…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Guardian Grand Theft Auto Leak 2022
Keza MacDonald, Keith Stuart and Alex Hern. (2022, September 19). Grand Theft Auto 6 leak: who hacked Rockstar and what was stolen?. Retrieved August 30, 2024.
Open source URL
[2]
SC Magazine Ragnar Locker 2021
Joe Uchill. (2021, December 3). Ragnar Locker reminds breach victims it can read the on-network incident response chat rooms. Retrieved August 30, 2024.
Open source URL
[3]
Microsoft DEV-0537
Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.
Open source URL
[4]
Sentinel Labs NullBulge 2024
Jim Walter. (2024, July 16). NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI. Retrieved August 30, 2024.
Open source URL
[5]
Permiso Scattered Spider 2023
Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.
Open source URL
[6]
Github TruffleSecurity Trufflehog April 2025
Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.
Open source URL
[7]
CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL
[8]
TrustedSec OOB Communications
Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.
Open source URL
[9]
CISA Scattered Spider Advisory November 2023
CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
Open source URL
[10]
MSTIC DEV-0537 Mar 2022
MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
Open source URL
[11]
Guardian Grand Theft Auto Leak 2022
Keza MacDonald, Keith Stuart and Alex Hern. (2022, September 19). Grand Theft Auto 6 leak: who hacked Rockstar and what was stolen?. Retrieved August 30, 2024.
Open source URL
[12]
Guardian Grand Theft Auto Leak 2022
Keza MacDonald, Keith Stuart and Alex Hern. (2022, September 19). Grand Theft Auto 6 leak: who hacked Rockstar and what was stolen?. Retrieved August 30, 2024.
Open source URL
[13]
Microsoft DEV-0537
Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.
Open source URL
[14]
Microsoft DEV-0537
Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.
Open source URL
[15]
Permiso Scattered Spider 2023
Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.
Open source URL
[16]
Permiso Scattered Spider 2023
Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.
Open source URL
[17]
SC Magazine Ragnar Locker 2021
Joe Uchill. (2021, December 3). Ragnar Locker reminds breach victims it can read the on-network incident response chat rooms. Retrieved August 30, 2024.
Open source URL
[18]
SC Magazine Ragnar Locker 2021
Joe Uchill. (2021, December 3). Ragnar Locker reminds breach victims it can read the on-network incident response chat rooms. Retrieved August 30, 2024.
Open source URL
[19]
Sentinel Labs NullBulge 2024
Jim Walter. (2024, July 16). NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI. Retrieved August 30, 2024.
Open source URL
[20]
Sentinel Labs NullBulge 2024
Jim Walter. (2024, July 16). NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI. Retrieved August 30, 2024.
Open source URL
[21]
mitre-attackT1213.005
Open source URL
[22]
mitre-attackT1213.005
Open source URL
[23]
mitre-attackT1213.005
Open source URL
[24]
Github TruffleSecurity Trufflehog April 2025
Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.
Open source URL
[25]
CISA AA20-259A Iran-Based Actor September 2020
CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
Open source URL
[26]
TrustedSec OOB Communications
Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.
Open source URL
[27]
CISA Scattered Spider Advisory November 2023
CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
Open source URL
[28]
MSTIC DEV-0537 Mar 2022
MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use