Detect Chat Messages in Splunk
Adversaries may directly collect unsecured credentials stored or passed through user communication services. Corporate chat tools including Slack, Microsoft Teams, Jira, Confluence, and email frequently contain credentials shared between employees — API keys, passwords, database connection strings, SSH keys, and authentication tokens. LAPSUS$ specifically targeted Slack, Teams, JIRA, and Confluence to hunt for exposed credentials supporting privilege escalation and lateral movement. Adversaries may access stored chat logs on endpoints, query chat APIs with compromised tokens, compromise Slack integrations/bots, or search through message history for sensitive content.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.008 Chat Messages
- Canonical reference
- https://attack.mitre.org/techniques/T1552/008/
SPL Detection Query
index=wineventlog OR index=o365 (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="o365:management:activity")
(
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(
(TargetFilename="*\\Slack\\storage\\*" OR TargetFilename="*\\Slack\\logs\\*")
OR
(TargetFilename="*\\Microsoft\\Teams\\Local Storage\\*" OR TargetFilename="*\\Teams\\Blob_storage\\*")
)
NOT (Image IN ("*\\Slack.exe", "*\\Teams.exe", "*\\msedgewebview2.exe", "*\\MicrosoftEdge*"))
| eval Platform=if(match(TargetFilename, "Slack"), "Slack", "Teams")
| eval AlertType="ChatApp_LocalDB_Access"
| table _time, host, User, Image, TargetFilename, Platform, AlertType
)
OR
(
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(CommandLine="*api.slack.com*" AND (CommandLine="*xoxb-*" OR CommandLine="*xoxp-*" OR CommandLine="*token=*"))
OR
(CommandLine="*graph.microsoft.com*" AND CommandLine="*chats*" AND CommandLine="*Bearer*")
)
| eval AlertType="ChatAPI_TokenUse"
| table _time, host, User, Image, CommandLine, AlertType
)
OR
(
sourcetype="o365:management:activity"
Workload="MicrosoftTeams"
Operation IN ("MessageSentEvent", "ChatMessageCreatedEvent")
UserId!='app@sharepoint'
| eval AlertType="Teams_Message_Audit"
| stats count as MsgCount, values(UserId) as Users by ClientIP, span(_time, 5m)
| where MsgCount >= 50 // Bulk message access/export
| table _time, ClientIP, Users, MsgCount, AlertType
)
| sort - _timeDetects chat application credential access using Sysmon Event 11 for Slack and Teams local storage database access by unexpected processes, Sysmon Event 1 for direct chat API calls with authentication tokens, and O365 audit logs for bulk Teams message access (50+ messages in 5 minutes indicating programmatic data collection).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Backup agents reading chat application local storage
- Enterprise compliance/DLP tools scanning chat data
- IT support tools accessing Teams/Slack logs
- Legitimate third-party integrations accessing local storage
- Automated testing frameworks accessing chat data
Other platforms for T1552.008
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Access Slack Local Storage Database
Expected signal: Sysmon Event ID 1: powershell.exe with Get-ChildItem and Slack\storage path. Sysmon Event ID 11: file access events for Slack storage files. Process parent chain visible in event.
- Test 2Extract Teams Session Cookies
Expected signal: Sysmon Event ID 1: powershell.exe with Get-ChildItem and Teams Cookies path. Sysmon Event ID 11: file access for Teams Cookies file.
- Test 3Query Slack API for Messages
Expected signal: Linux auditd EXECVE for curl with api.slack.com and xoxb- token. HTTPS connection to slack.com:443. Network connection event with slack.com as destination.
- Test 4Search Jira/Confluence for Credentials
Expected signal: Linux auditd EXECVE for curl with atlassian.net URL and Bearer token. HTTPS connection to atlassian.net:443. Response contains Jira tickets with credential content.
References (7)
- https://attack.mitre.org/techniques/T1552/008/
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
- https://api.slack.com/authentication/token-types
- https://learn.microsoft.com/en-us/graph/api/chatmessage-list
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.008/T1552.008.md
- https://www.csoonline.com/article/3649561/lapsus-group-profile-data-extortion-as-a-business.html
- https://api.slack.com/enterprise/audit-logs
Unlock Pro Content
Get the full detection package for T1552.008 including response playbook, investigation guide, and atomic red team tests.