Esc

Chat Messages - T1552.008

(ATT&CK® Technique)

Definition

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1552008["Chat Messages"] --> |accesses| Credential["Credential"]; class T1552008 OffensiveTechniqueNode;
        class Credential ArtifactNode; click Credential href "/dao/artifact/d3f:Credential";
        click T1552008 href "/offensive-technique/attack/T1552.008/"; click Credential href "/dao/artifact/d3f:Credential";DecoyUserCredential["Decoy User Credential"] -->
          | spoofs | Credential["Credential"];

          DecoyUserCredential["Decoy User Credential"] -.->
            | may-deceive | T1552008["Chat Messages"] ;
          class DecoyUserCredential DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click DecoyUserCredential href "/technique/d3f:DecoyUserCredential"; CredentialCompromiseScopeAnalysis["Credential Compromise Scope Analysis"] -->
          | analyzes | Credential["Credential"];

          CredentialCompromiseScopeAnalysis["Credential Compromise Scope Analysis"] -.->
            | may-detect | T1552008["Chat Messages"] ;
          class CredentialCompromiseScopeAnalysis DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click CredentialCompromiseScopeAnalysis href "/technique/d3f:CredentialCompromiseScopeAnalysis"; AuthenticationCacheInvalidation["Authentication Cache Invalidation"] -->
          | deletes | Credential["Credential"];

          AuthenticationCacheInvalidation["Authentication Cache Invalidation"] -.->
            | may-evict | T1552008["Chat Messages"] ;
          class AuthenticationCacheInvalidation DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click AuthenticationCacheInvalidation href "/technique/d3f:AuthenticationCacheInvalidation"; CredentialRevocation["Credential Revocation"] -->
          | deletes | Credential["Credential"];

          CredentialRevocation["Credential Revocation"] -.->
            | may-evict | T1552008["Chat Messages"] ;
          class CredentialRevocation DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click CredentialRevocation href "/technique/d3f:CredentialRevocation"; CredentialRotation["Credential Rotation"] -->
          | regenerates | Credential["Credential"];

          CredentialRotation["Credential Rotation"] -.->
            | may-harden | T1552008["Chat Messages"] ;
          class CredentialRotation DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click CredentialRotation href "/technique/d3f:CredentialRotation"; Multi-factorAuthentication["Multi-factor Authentication"] -->
          | uses | Credential["Credential"];

          Multi-factorAuthentication["Multi-factor Authentication"] -.->
            | may-harden | T1552008["Chat Messages"] ;
          class Multi-factorAuthentication DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click Multi-factorAuthentication href "/technique/d3f:Multi-factorAuthentication"; CredentialTransmissionScoping["Credential Transmission Scoping"] -->
          | isolates | Credential["Credential"];

          CredentialTransmissionScoping["Credential Transmission Scoping"] -.->
            | may-isolate | T1552008["Chat Messages"] ;
          class CredentialTransmissionScoping DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click CredentialTransmissionScoping href "/technique/d3f:CredentialTransmissionScoping"; ReissueCredential["Reissue Credential"] -->
          | restores | Credential["Credential"];

          ReissueCredential["Reissue Credential"] -.->
            | may-restore | T1552008["Chat Messages"] ;
          class ReissueCredential DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click ReissueCredential href "/technique/d3f:ReissueCredential"; CredentialHardening["Credential Hardening"] -->
          | hardens | Credential["Credential"];

          CredentialHardening["Credential Hardening"] -.->
            | may-harden | T1552008["Chat Messages"] ;
          class CredentialHardening DefensiveTechniqueNode;
          class Credential ArtifactNode;
          click CredentialHardening href "/technique/d3f:CredentialHardening";

json