T1213.005 — Messaging Applications

Tactic: Collection · Platforms: Office Suite, SaaS

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing /…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (2)

T1213.005 Data from Information Repositories: Messaging Applications

title: "T1213.005 Data from Information Repositories: Messaging Applications"
id: 9761754b-6772-4e16-8558-47d05e2c70f3
description: 'Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TimeWindow, MessageExportThreshold, UserContext, AccessMethod.'
references:
  - https://attack.mitre.org/techniques/T1213/005
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.collection
  - attack.t1213.005

logsource:
  product: saas
  service: slack

detection:
  selection_export:
    action: 'workspace_export'
  selection_download:
    action: 'file_downloaded'

  condition: 1 of selection_*

falsepositives:
  - Authorized compliance or legal staff performing a scheduled workspace data export for e-discovery, or normal collaborative file downloads by workspace members.

level: high

T1213.005 Data from Information Repositories: Messaging Applications

title: "T1213.005 Data from Information Repositories: Messaging Applications"
id: 34411fe3-8f13-4a83-9100-bb5c3d0603eb
description: 'Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: UserRole, GeoRiskScore, AccessVolume.'
references:
  - https://attack.mitre.org/techniques/T1213/005
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.collection
  - attack.t1213.005

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'MailItemsAccessed'
      - 'SearchQueryInitiatedExchange'

  condition: selection

falsepositives:
  - Legitimate eDiscovery searches performed by compliance or legal staff; bulk collection from messaging apps requires an access volume threshold best expressed as a correlation rule.

level: medium

Related sub-techniques

Explore