Elastic Defend high stable eql

Slack Workspace Files Accessed by Osascript

Identifies the Osascript process accessing sensitive Slack files. Adversaries can steal certain Slack files that allows them to log in to the Slack workspace as that user without a password in order to collect additional sensitive data or spy on the organization.

View Source

Detection Logic

file where event.action == "open" and 
 file.path like~ ("/Users/*/Library/Application Support/Slack/storage/slack-workspaces.db", 
                  "/Users/*/Library/Application Support/Slack/Cookies.sqlite", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/slack-workspaces.db", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/Cookies.sqlite") and 
 process.name == "osascript"

Field Validations

Loading…

Comments (0)

Loading comments...