Messaging Applications

// T1213.005 - Messaging Application Data Mining
// Detects bulk or suspicious access to Teams/Slack message content via MDCA and O365 audit logs
let LookbackPeriod = 24h;
let BulkEventThreshold = 100;
let SuspiciousExportOps = dynamic(["Export", "ContentSearch", "SearchExported", "ExportReport", "ViewedSearchExported", "BulkDownload", "SearchCreated"]);
// Branch 1: High-volume messaging app activity via Microsoft Defender for Cloud Apps
let CloudAppBulkAccess =
    CloudAppEvents
    | where Timestamp > ago(LookbackPeriod)
    | where AppName has_any ("Microsoft Teams", "Slack", "Google Chat", "Webex", "Workplace from Meta")
    | where ActionType in~ (
        "FileDownloaded", "FilePreviewed", "FileAccessed",
        "MessageRead", "ChannelRead",
        "SearchPerformed", "ItemShared"
    )
    | summarize
        EventCount = count(),
        UniqueActions = dcount(ActionType),
        Actions = make_set(ActionType, 10),
        UniqueChannels = dcount(tostring(RawEventData.ChannelName)),
        SourceIPs = make_set(IPAddress, 5),
        FirstSeen = min(Timestamp),
        LastSeen = max(Timestamp)
        by AccountDisplayName, AccountObjectId, AppName
    | where EventCount > BulkEventThreshold
    | extend DetectionSource = "CloudAppEvents", RiskIndicator = "High-volume messaging app data access";
// Branch 2: Microsoft 365 compliance/eDiscovery export of Teams data
let TeamsComplianceExport =
    OfficeActivity
    | where TimeGenerated > ago(LookbackPeriod)
    | where RecordType in ("MicrosoftTeams", "SecurityComplianceCenter")
    | where Operation has_any (SuspiciousExportOps)
    | summarize
        EventCount = count(),
        Operations = make_set(Operation, 10),
        UniqueActions = dcount(Operation),
        SourceIPs = make_set(ClientIP, 5),
        FirstSeen = min(TimeGenerated),
        LastSeen = max(TimeGenerated)
        by UserId, RecordType
    | extend AccountDisplayName = UserId, AccountObjectId = "",
             AppName = "Microsoft Teams (Compliance)",
             Actions = Operations, UniqueChannels = 0,
             DetectionSource = "OfficeActivity", RiskIndicator = "Teams compliance export/search operation";
// Combine results
union CloudAppBulkAccess, TeamsComplianceExport
| project FirstSeen, LastSeen, AccountDisplayName, AppName, SourceIPs,
          EventCount, UniqueActions, Actions, DetectionSource, RiskIndicator
| sort by EventCount desc

// T1213.005 - Messaging Application Data Mining
// Detects bulk Teams/Slack data access via O365 Management Activity and Slack Enterprise audit logs
(
  index=o365 sourcetype="o365:management:activity"
  (Workload="MicrosoftTeams" OR Workload="SecurityComplianceCenter")
)
OR
(
  index=slack_audit sourcetype="slack:audit"
  (action="file_downloaded" OR action="search_performed" OR action="channel_joined"
   OR action="message_channel_export" OR action="user_channel_join")
)
| eval app_name=coalesce(Workload, "Slack")
| eval operation_name=coalesce(Operation, action)
| eval source_ip=coalesce(ClientIP, ip_address)
| eval user_id=coalesce(UserId, mvindex(split(actor, ":"), 1))
| eval is_export=if(match(lower(operation_name),
    "export|contentsearch|searchexported|viewedsearchexported|bulkdownload|searchcreated"), 1, 0)
| eval is_bulk_read=if(match(lower(operation_name),
    "messagelist|channellist|filelist|filedownload|search_performed"), 1, 0)
| bin _time span=1h
| stats
    count as EventCount,
    sum(is_export) as ExportEvents,
    sum(is_bulk_read) as BulkReadEvents,
    dc(operation_name) as UniqueOps,
    values(operation_name) as Operations,
    values(source_ip) as SourceIPs,
    earliest(_time) as FirstEvent,
    latest(_time) as LastEvent
    by user_id, app_name
| where EventCount > 50 OR ExportEvents >= 1
| eval RiskLevel=case(
    ExportEvents >= 1 AND EventCount > 100, "High",
    ExportEvents >= 1, "Medium",
    EventCount > 200, "Medium",
    BulkReadEvents > 50, "Medium",
    1=1, "Low"
)
| where RiskLevel IN ("High", "Medium")
| table FirstEvent, LastEvent, user_id, app_name, EventCount, ExportEvents, BulkReadEvents, UniqueOps, Operations, SourceIPs, RiskLevel
| sort - EventCount

// T1213.005 - Messaging Application Data Mining
// Detects bulk or suspicious access to Teams/Slack/Google Chat message content via ECS-normalized logs
sequence by user.name with maxspan=1h
  [any where event.dataset in ("o365.audit", "google_workspace.admin", "slack.audit")
   and (
     (event.provider == "MicrosoftTeams" and event.action in ("MessageRead", "ChannelRead", "FileDownloaded", "FilePreviewed", "FileAccessed", "SearchCreated", "SearchExported", "ExportReport", "ContentSearch", "BulkDownload"))
     or (event.provider == "Slack" and event.action in ("file_downloaded", "search_performed", "channel_joined", "message_channel_export", "user_channel_join"))
     or (event.provider == "Google Chat" and event.action in ("download", "view", "export", "search"))
   )
  ] with runs=50

// Supplemental: Hunting query for export/eDiscovery abuse
// any where event.dataset == "o365.audit"
// and event.provider in ("MicrosoftTeams", "SecurityComplianceCenter")
// and event.action in ("Export", "ContentSearch", "SearchExported", "ExportReport", "ViewedSearchExported", "BulkDownload", "SearchCreated")

// T1213.005 - Messaging Application Data Mining
// Detects bulk/suspicious access to Teams, Slack, and Google Chat via QRadar normalized log sources
SELECT
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS first_event,
  DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS last_event,
  username,
  CATEGORYNAME(category) AS event_category,
  LOGSOURCENAME(logsourceid) AS log_source,
  COUNT(*) AS event_count,
  SUM(CASE WHEN LOWER(QIDNAME(qid)) LIKE '%export%'
           OR LOWER(QIDNAME(qid)) LIKE '%search%'
           OR LOWER(QIDNAME(qid)) LIKE '%contentsearch%'
           OR LOWER(QIDNAME(qid)) LIKE '%bulkdownload%' THEN 1 ELSE 0 END) AS export_events,
  SUM(CASE WHEN LOWER(QIDNAME(qid)) LIKE '%download%'
           OR LOWER(QIDNAME(qid)) LIKE '%fileaccess%'
           OR LOWER(QIDNAME(qid)) LIKE '%messageread%'
           OR LOWER(QIDNAME(qid)) LIKE '%channelread%' THEN 1 ELSE 0 END) AS bulk_read_events,
  ARRAY_AGG(DISTINCT sourceip) AS source_ips,
  ARRAY_AGG(DISTINCT QIDNAME(qid)) AS operations
FROM events
WHERE
  starttime >= NOW() - 86400
  AND (
    LOGSOURCETYPEID(logsourceid) IN (
      SELECT id FROM logsourcetypes WHERE name ILIKE '%Office 365%'
        OR name ILIKE '%Microsoft Teams%'
        OR name ILIKE '%Slack%'
        OR name ILIKE '%Google Workspace%'
        OR name ILIKE '%Google GSuite%'
    )
  )
  AND (
    LOWER(QIDNAME(qid)) LIKE '%teams%'
    OR LOWER(QIDNAME(qid)) LIKE '%slack%'
    OR LOWER(QIDNAME(qid)) LIKE '%chat%'
    OR LOWER(QIDNAME(qid)) LIKE '%message%'
    OR LOWER(QIDNAME(qid)) LIKE '%channel%'
    OR CATEGORYNAME(category) ILIKE '%messaging%'
    OR CATEGORYNAME(category) ILIKE '%collaboration%'
  )
GROUP BY
  username,
  CATEGORYNAME(category),
  LOGSOURCENAME(logsourceid),
  BUCKET(starttime, 3600)
HAVING
  event_count > 50
  OR export_events >= 1
ORDER BY event_count DESC

// T1213.005 - Messaging Application Data Mining
// Detects bulk or export-based access to Teams/Slack/Google Chat via Sumo Logic CSE and cloud audit indexes
(_sourceCategory="o365/audit" OR _sourceCategory="slack/audit" OR _sourceCategory="google/workspace/audit")
| json field=_raw "Workload" as workload nodrop
| json field=_raw "Operation" as operation nodrop
| json field=_raw "UserId" as user_id nodrop
| json field=_raw "ClientIP" as client_ip nodrop
| json field=_raw "action" as slack_action nodrop
| json field=_raw "actor" as slack_actor nodrop
| json field=_raw "ip_address" as slack_ip nodrop
| json field=_raw "email" as google_user nodrop
| json field=_raw "event_type" as google_event nodrop
// Normalize fields across sources
| eval app_name = if(!isNull(workload), workload,
    if(!isNull(slack_action), "Slack",
    if(!isNull(google_event), "GoogleChat", "Unknown")))
| eval op_name = if(!isNull(operation), operation,
    if(!isNull(slack_action), slack_action,
    if(!isNull(google_event), google_event, "unknown")))
| eval uid = if(!isNull(user_id), user_id,
    if(!isNull(slack_actor), slack_actor,
    if(!isNull(google_user), google_user, "unknown")))
| eval src_ip = if(!isNull(client_ip), client_ip,
    if(!isNull(slack_ip), slack_ip, "unknown"))
// Flag export and bulk read operations
| eval is_export = if(op_name matches /(?i)(export|contentsearch|searchexported|viewedsearchexported|bulkdownload|searchcreated)/, 1, 0)
| eval is_bulk_read = if(op_name matches /(?i)(messagelist|channellist|filelist|filedownload|messageread|channelread|search_performed|file_downloaded)/, 1, 0)
// Restrict to relevant apps
| where app_name in ("MicrosoftTeams", "SecurityComplianceCenter", "Slack", "GoogleChat", "Webex")
   OR op_name matches /(?i)(team|slack|chat|channel|message)/
// Time bucket aggregation (1-hour windows)
| timeslice 1h
| stats
    count as EventCount,
    sum(is_export) as ExportEvents,
    sum(is_bulk_read) as BulkReadEvents,
    dcount(op_name) as UniqueOps,
    values(op_name) as Operations,
    values(src_ip) as SourceIPs,
    min(_messageTime) as FirstEvent,
    max(_messageTime) as LastEvent
    by uid, app_name, _timeslice
| where EventCount > 50 or ExportEvents >= 1
| eval RiskLevel = if(ExportEvents >= 1 and EventCount > 100, "High",
    if(ExportEvents >= 1, "Medium",
    if(EventCount > 200, "Medium",
    if(BulkReadEvents > 50, "Medium", "Low"))))
| where RiskLevel in ("High", "Medium")
| fields FirstEvent, LastEvent, uid, app_name, EventCount, ExportEvents, BulkReadEvents, UniqueOps, Operations, SourceIPs, RiskLevel
| sort by EventCount desc

rule t1213_005_messaging_app_data_mining {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk or export-based data mining of messaging applications (Teams, Slack, Google Chat) indicating adversarial credential or sensitive data harvesting (T1213.005)"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1213.005"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1213/005/"
    created = "2026-04-19"

  events:
    // Match cloud application audit events for messaging platforms
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name in (
      "Microsoft Teams",
      "Microsoft Office 365",
      "Slack",
      "Google Chat",
      "Google Workspace",
      "Webex"
    )
    // Match bulk read, search, download, or export operations
    (
      $e.metadata.event_subtype in (
        "FileDownloaded", "FilePreviewed", "FileAccessed",
        "MessageRead", "ChannelRead", "SearchPerformed",
        "ItemShared", "file_downloaded", "search_performed",
        "channel_joined", "message_channel_export"
      )
      or re.regex(
        $e.network.application_protocol,
        `(?i)(export|contentsearch|searchexported|bulkdownload|searchcreated)`
      )
      or re.regex(
        $e.security_result.summary,
        `(?i)(export|content.search|bulk.download|search.created|edisc)`
      )
    )
    // Bind user principal
    $user = $e.principal.user.userid
    $app = $e.metadata.product_name
    $src_ip = $e.principal.ip

  match:
    $user, $app over 1h

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $unique_ops = count_distinct($e.metadata.event_subtype)
    $unique_src_ips = count_distinct($e.principal.ip)
    $export_count = sum(
      if(
        re.regex($e.metadata.event_subtype, `(?i)(export|contentsearch|searchexported|bulkdownload|searchcreated)`),
        1, 0
      )
    )
    $risk_score = if($export_count >= 1 and $event_count > 100, 90,
      if($export_count >= 1, 70,
      if($event_count > 200, 65,
      if($event_count > 50, 50, 30))))

  condition:
    #e > 50 or $export_count >= 1
}

// T1213.005 - Messaging Application Data Mining
// Detects bulk or export-based access to Teams/Slack/Google Chat via CrowdStrike Falcon SIEM Connector and cloud audit event ingestion

// Primary detection: high-volume messaging app activity from cloud audit events
#event_simpleName = "OAuthAppActivity"
  OR #event_simpleName = "CloudAuditEvent"
  OR #event_simpleName = "SaaSApplicationActivity"
| appName = /(?i)(teams|slack|google.chat|webex|workplace)/
| operationType = /(?i)(filedownload|filepreviewed|fileaccessed|messageread|channelread|searchperformed|itemshared|file_downloaded|search_performed|channel_joined|message_channel_export|export|contentsearch|searchexported|bulkdownload|searchcreated)/
| timechart(span=1h) function=[count(aid, as=EventCount), count(distinct(operationType), as=UniqueOps), count(distinct(RemoteIP), as=UniqueIPs)] by UserPrincipalName, appName
| EventCount > 50 OR operationType = /(?i)(export|contentsearch|searchexported|bulkdownload|searchcreated)/
| eval ExportFlag = if(match(operationType, /(?i)(export|contentsearch|searchexported|bulkdownload|searchcreated)/), true, false)
| eval RiskLevel = case(
    ExportFlag == true AND EventCount > 100, "High",
    ExportFlag == true, "Medium",
    EventCount > 200, "Medium",
    EventCount > 50, "Low",
    true, "Informational"
  )
| RiskLevel IN ("High", "Medium")
| groupBy([UserPrincipalName, appName, RiskLevel], function=[
    count(aid, as=TotalEvents),
    collect(operationType, limit=10, as=OperationTypes),
    collect(RemoteIP, limit=5, as=SourceIPs),
    min(@timestamp, as=FirstSeen),
    max(@timestamp, as=LastSeen)
  ])
| sort(TotalEvents, order=desc)
| select([FirstSeen, LastSeen, UserPrincipalName, appName, TotalEvents, OperationTypes, SourceIPs, RiskLevel])