Data from Information Repositories: Messaging Applications
- ID
- T1213.005
- Tactics
- TA0009 Collection
- Sub-technique of
- T1213 Data from Information Repositories
- Platforms
- Office Suite, SaaS
- Data sources
- Application Log Content, Logon Session Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:
- Testing / development credentials (i.e., Chat Messages)
- Source code snippets
- Links to network shares and other internal resources
- Proprietary data[2]
- Discussions about ongoing incident response efforts[3][4]
In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.[5][6]
Detection
- DET0567 Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments
Data components: Application Log Content, Logon Session Creation
Mitigations (3)
- M1017 User Training
Develop and publish policies that define acceptable information to be posted in chat applications.
- M1047 Audit
Preemptively search through communication services to find inappropriately shared data, and take actions to reduce exposure when found.
- M1060 Out-of-Band Communications Channel
Implement secure out-of-band communication channels to use as an alternative to in-network chat applications during a security incident. This ensures that critical communications remain secure even if primary messaging channels are compromised by adversaries.[1]