T1552.008sub-technique of T1552 Unsecured Credentials
Chat Messages
SaaS · Office Suitenothing on this site yetT1552.008 on attack.mitre.org
Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Unsecured Credentials Shared in Chat Messages
- Detection correlates message events in email and collaboration tools (e.g., Outlook, Teams) that contain regex-like patterns resembling credentials, API keys, or tokens. Anomalous forwarding or bulk copy activity of chat/email content containing secrets is flagged.
- Detection monitors SaaS collaboration tools (e.g., Slack, Zoom, Jira) for messages or files containing credential-like patterns, or for suspicious API calls retrieving bulk chat histories by non-admin users.
what reduces it
- M1017 User Training. Ensure that developers and system administrators are aware of the risk associated with sharing unsecured passwords across communication services.
- M1047 Audit. Preemptively search through communication services to find shared unsecured credentials. Searching for common patterns like "`password is `", “`password=`” and take actions to reduce exposure when found.