Unsecured Credentials: Chat Messages `T1552.008`

Tactic: Credential Access

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	open	File Open

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	2	`eq` 2	`open`
`TargetFilename`	2	`wildcard` 2	`/users//library/application support/slack/cookies.sqlite`, `/users//library/application...`, `/users/*/library/containers/com.tinyspeck.slackmacgap/dat...`
`process.code_signature.exists`	1	`eq` 1	`false`
`process.code_signature.trusted`	1	`eq` 1	`false`
`process_name`	1	`eq` 1	`osascript`

Top indicator values (8 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`eq`	`open` elasticSlack Workspace Files Accessed by Osascript elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	2	52
`TargetFilename`	`wildcard`	`/users/*/library/application support/slack/cookies.sqlite` elasticSlack Workspace Files Accessed by Osascript elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	2	2
`TargetFilename`	`wildcard`	`/users/*/library/application support/slack/storage/slack-workspaces.db` elasticSlack Workspace Files Accessed by Osascript elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	2	2
`TargetFilename`	`wildcard`	`/users/*/library/containers/com.tinyspeck.slackmacgap/data/library/applicatio...` elasticSlack Workspace Files Accessed by Osascript elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	2	2
`TargetFilename`	`wildcard`	`/users/*/library/containers/com.tinyspeck.slackmacgap/data/library/applicatio...` elasticSlack Workspace Files Accessed by Osascript elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	2	2
`process.code_signature.exists`	`eq`	`false` elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	1	119
`process.code_signature.trusted`	`eq`	`false` elasticSlack Workspace Files Accessed by Unsigned or Untrusted Process	1	115
`process_name`	`eq`	`osascript` elasticSlack Workspace Files Accessed by Osascript	1	46

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint