Slack Workspace Files Accessed by Unsigned or Untrusted Process

[rule]
description = """
Identifies an untrusted or unsigned process accessing sensitive Slack files. Adversaries can steal certain Slack files
that will allow them to log in to the Slack workspace as that user without a password in order to collect additional
sensitive data or spy on the organization.
"""
id = "2f1ca71e-536b-4721-9aa8-06bc019541de"
license = "Elastic License v2"
name = "Slack Workspace Files Accessed by Unsigned or Untrusted Process"
os_list = ["macos"]
version = "1.0.5"

query = '''
file where event.action == "open" and 
 file.path like~ ("/Users/*/Library/Application Support/Slack/storage/slack-workspaces.db", 
                  "/Users/*/Library/Application Support/Slack/Cookies.sqlite", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/slack-workspaces.db", 
                  "/Users/*/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/Cookies.sqlite") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false)
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.008"
name = "Chat Messages"
reference = "https://attack.mitre.org/techniques/T1552/008/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"