Detect Chat Messages in Elastic Security
Adversaries may directly collect unsecured credentials stored or passed through user communication services. Corporate chat tools including Slack, Microsoft Teams, Jira, Confluence, and email frequently contain credentials shared between employees — API keys, passwords, database connection strings, SSH keys, and authentication tokens. LAPSUS$ specifically targeted Slack, Teams, JIRA, and Confluence to hunt for exposed credentials supporting privilege escalation and lateral movement. Adversaries may access stored chat logs on endpoints, query chat APIs with compromised tokens, compromise Slack integrations/bots, or search through message history for sensitive content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.008 Chat Messages
- Canonical reference
- https://attack.mitre.org/techniques/T1552/008/
Elastic Detection Query
sequence by host.name with maxspan=5m
[file where event.action in ("open", "read") and
(
file.path like~ "*\\Slack\\storage\\*" or
file.path like~ "*\\Slack\\logs\\*" or
file.path like~ "*\\Slack\\Cache\\*" or
file.path like~ "*\\Microsoft\\Teams\\Local Storage\\*" or
file.path like~ "*\\Teams\\Blob_storage\\*" or
file.path like~ "*\\Teams\\LocalDb\\*"
) and
not process.name in~ ("Slack.exe", "Teams.exe", "msedgewebview2.exe", "chrome.exe", "slack", "teams", "electron")]
any where true
| sequence by host.name with maxspan=1m
[file where event.action in ("open", "read") and
(file.name like~ "*token*" or file.name like~ "*session*" or file.name like~ "*cookies*") and
(file.path like~ "*\\Slack\\*" or file.path like~ "*\\Teams\\*" or file.path like~ "*\\Discord\\*") and
not process.name in~ ("Slack.exe", "Teams.exe", "Discord.exe", "slack", "teams", "discord")]
| any where
(
process.command_line like~ "*slack.com/api*" or
process.command_line like~ "*api.slack.com*" or
process.command_line like~ "*graph.microsoft.com*chats*"
) and
(
process.command_line like~ "*xoxb-*" or
process.command_line like~ "*xoxp-*" or
process.command_line like~ "*Bearer*" or
process.command_line like~ "*token=*"
)Detects three patterns of T1552.008 Chat Messages credential theft: (1) non-chat processes reading Slack or Teams local storage/cache directories, (2) unauthorized processes accessing token/session/cookie files from chat application directories, and (3) command-line API calls to Slack or Microsoft Graph chat endpoints using bearer tokens or Slack API token prefixes (xoxb/xoxp). Uses ECS fields across file and process event categories.
Data Sources
Required Tables
False Positives & Tuning
- Backup or disk imaging tools (e.g. Veeam, Acronis, robocopy scripts) legitimately read chat app directories during system backup jobs
- Security products such as EDR agents, DLP tools, or AV scanners that enumerate user profile directories including Slack/Teams storage paths during scheduled scans
- IT support scripts using PowerShell or curl to query Teams Graph API with delegated tokens during legitimate helpdesk automation workflows
Other platforms for T1552.008
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Access Slack Local Storage Database
Expected signal: Sysmon Event ID 1: powershell.exe with Get-ChildItem and Slack\storage path. Sysmon Event ID 11: file access events for Slack storage files. Process parent chain visible in event.
- Test 2Extract Teams Session Cookies
Expected signal: Sysmon Event ID 1: powershell.exe with Get-ChildItem and Teams Cookies path. Sysmon Event ID 11: file access for Teams Cookies file.
- Test 3Query Slack API for Messages
Expected signal: Linux auditd EXECVE for curl with api.slack.com and xoxb- token. HTTPS connection to slack.com:443. Network connection event with slack.com as destination.
- Test 4Search Jira/Confluence for Credentials
Expected signal: Linux auditd EXECVE for curl with atlassian.net URL and Bearer token. HTTPS connection to atlassian.net:443. Response contains Jira tickets with credential content.
References (7)
- https://attack.mitre.org/techniques/T1552/008/
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
- https://api.slack.com/authentication/token-types
- https://learn.microsoft.com/en-us/graph/api/chatmessage-list
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.008/T1552.008.md
- https://www.csoonline.com/article/3649561/lapsus-group-profile-data-extortion-as-a-business.html
- https://api.slack.com/enterprise/audit-logs
Unlock Pro Content
Get the full detection package for T1552.008 including response playbook, investigation guide, and atomic red team tests.