Techniques › T1552.008 › AN0310
AN0310 Analytic 0310
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection monitors SaaS collaboration tools (e.g., Slack, Zoom, Jira) for messages or files containing credential-like patterns, or for suspicious API calls retrieving bulk chat histories by non-admin users. Identifies adversary behavior chains where chat logs are queried via APIs or integration bots to systematically extract sensitive material.</p>
- Detects
- T1552.008 Chat Messages
- Part of
- DET0111 Detect Unsecured Credentials Shared in Chat Messages
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:slack | chat.postMessage, files.upload, or discovery API calls involving token/credential regex | DC0038 Application Log Content |
| saas:okta | Unusual OAuth app requesting message-read scopes for Slack/Teams/Jira | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
IntegrationScope | Tune to ignore known enterprise bots with message-read access (e.g., DLP scanners) |
RegexPatterns | Customizable regex for detecting secret formats (JWT, OAuth tokens, SSH keys) |
UserContext | Correlate with user role to filter developers vs standard users |