T1552.008 — Chat Messages

Tactic: Credential Access · Platforms: SaaS, Office Suite

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (2)

T1552.008 Unsecured Credentials: Chat Messages

title: "T1552.008 Unsecured Credentials: Chat Messages"
id: e0bc3939-3ca8-45b6-93fb-e2ae1c512581
description: 'Detect Unsecured Credentials Shared in Chat Messages. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: IntegrationScope, RegexPatterns, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1552/008
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.008

logsource:
  product: saas
  service: slack

detection:
  selection_download:
    action: 'file_downloaded'
    entity.type: 'message'
  selection_app_scope:
    action: 'app_approved'

  condition: selection_download or selection_app_scope

falsepositives:
  - Routine message-file downloads by users or newly approved apps requesting broad message-history scopes for a legitimate integration.

level: medium

T1552.008 Unsecured Credentials: Chat Messages

title: "T1552.008 Unsecured Credentials: Chat Messages"
id: de34715a-e2d5-41e7-9fd3-2cec3ec7ce84
description: 'Detect Unsecured Credentials Shared in Chat Messages. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: RegexPatterns, AllowedDomains, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1552/008
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.008

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'FileDownloaded'
      - 'FilePreviewed'
    ObjectId|contains:
      - '.pem'
      - '.pfx'
      - '.key'
      - 'credentials'

  condition: selection

falsepositives:
  - Developers or administrators legitimately retrieving certificate or key files stored in SharePoint or OneDrive for authorized configuration tasks.

level: medium

Related sub-techniques

Explore