Techniques › T1552.008 › AN0309
AN0309 Analytic 0309
Office Suite · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection correlates message events in email and collaboration tools (e.g., Outlook, Teams) that contain regex-like patterns resembling credentials, API keys, or tokens. Anomalous forwarding or bulk copy activity of chat/email content containing secrets is flagged. Suspicious behavior includes users pasting secrets into direct messages or attaching config files with passwords.</p>
- Detects
- T1552.008 Chat Messages
- Part of
- DET0111 Detect Unsecured Credentials Shared in Chat Messages
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| m365:unified | MessageSend, MessageRead, or FileAttached events containing credential-like patterns | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
RegexPatterns | Customizable credential-detection regex (e.g., API_KEY=, bearer token formats) depending on enterprise apps in use |
AllowedDomains | Exclude known trusted domains or automated system-to-system messages |
TimeWindow | Adjust correlation period for bulk credential sharing events |