Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0567 — Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments
DET0567

Detecting Unauthorized Collection from Messaging Applications in SaaS and Office Environments

2 analytic(s) · 1 technique(s) detected

Analytics

2
AN1565 Analytic 1565
SaaS

Atypical access to Slack or Teams conversations via APIs, automation tokens, or bulk message export functionality, particularly after an account takeover or rare sign-in pattern. Often includes mass retrieval of chat history, download of message content, or scraping of workspace/channel metadata.

saas:slack conversations.history, files.list, users.info, audit_logs m365:signinlogs UserLoggedIn
[TimeWindow] Time interval to observe post-login message scraping behavior
[MessageExportThreshold] Number of messages or files accessed/downloaded to flag for review
[UserContext] User privilege level, team membership, or role context to suppress false positives
[AccessMethod] Direct user access vs API token, OAuth app, or bot interaction
AN1566 Analytic 1566
Office Suite

Suspicious access to Microsoft Teams chat messages via eDiscovery, Graph API, or export methods after rare or compromised sign-in. Often associated with excessive file access, sensitive content review, or anomaly from expected user behavior.

m365:unified TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport m365:signinlogs UserLoggedIn
[UserRole] Whether user is part of InfoSec, Legal, or expected to use Teams eDiscovery tools
[GeoRiskScore] Unusual country/IP sign-in patterns prior to Teams data export
[AccessVolume] Message or file threshold for triggering alert

Detected Techniques

1

Details

MITRE ID
DET0567
STIX ID
x-mitre-detection-strategy--c69d915c-0cbf-479e-b0b5-bebd7eb7e728
Analytics
2
Techniques Detected
1
By Tactic
Collection
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.