SIEM Consulting
Market
& News
Closing snapshots unavailable

Platforms / Security resources

MITRE ATT&CK

Enterprise v20 / 15 tactics / 227 techniques / 479 sub-techniques

Collection / T1213.005

Messaging Applications

Sub-technique / Enterprise ATT&CK

Official MITRE entry

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:

  • Testing / development credentials (i.e., Chat Messages)
  • Source code snippets
  • Links to network shares and other internal resources
  • Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022)
  • Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537)

In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)

Platforms
Office Suite, SaaS
MITRE record updated
May 12, 2026

Parent technique: T1213 Data from Information Repositories

Source references

Source: MITRE ATT&CK Enterprise v20, retrieved 2026-10-31. MITRE ATT&CK is a registered trademark of The MITRE Corporation.