Elastic Defend high stable eql

Slack Workspace Files Accessed by Unsigned or Untrusted Process

Identifies an untrusted or unsigned process accessing sensitive Slack files. Adversaries can steal certain Slack files that will allow them to log in to the Slack workspace as that user without a password in order to collect additional sensitive data or spy on the organization.

View Source

Detection Logic

file where event.action == "open" and 
 file.path like~ ("/Users/*/Library/Application Support/Slack/storage/slack-workspaces.db", 
                  "/Users/*/Library/Application Support/Slack/Cookies.sqlite", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/slack-workspaces.db", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/Cookies.sqlite") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false)

Field Validations

Loading…

Comments (0)

Loading comments...