AnalysisType: rule
Filename: slack_app_access_expanded.py
RuleID: "Slack.AuditLogs.AppAccessExpanded"
DisplayName: "Slack App Access Expanded"
Enabled: true
LogTypes:
- Slack.AuditLogs
Tags:
- Slack
- Privilege Escalation
- Account Manipulation
Reports:
MITRE ATT&CK:
- TA0004:T1098
Severity: Medium
Description: Detects when a Slack App has had its permission scopes expanded
Reference: https://slack.com/intl/en-gb/help/articles/1500009181142-Manage-app-settings-and-permissions
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
- action
- p_any_ip_addresses
- p_any_emails
Tests:
- Name: App Scopes Expanded
ExpectedResult: true
Log:
{
"action": "app_scopes_expanded",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "A012B3CDEFG",
"name": "username",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace",
"id": "T01234N56GB",
"name": "test-workspace",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"date_create": "2022-07-28 16:48:14",
"details":
{
"granular_bot_token": true,
"is_internal_integration": false,
"is_token_rotation_enabled_app": false,
"new_scopes":
[
"app_mentions:read",
"channels:join",
"channels:read",
"chat:write",
"chat:write.public",
"team:read",
"users:read",
"im:history",
"groups:read",
"reactions:write",
"groups:history",
"channels:history",
],
"previous_scopes":
[
"app_mentions:read",
"commands",
"channels:join",
"channels:read",
"chat:write",
"chat:write.public",
"users:read",
"groups:read",
"reactions:write",
"groups:history",
"channels:history",
],
},
"entity":
{
"type": "workspace",
"workspace":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
},
},
"id": "9d9b76ce-47bb-4838-a96a-1b5fd4d1b564",
}
- Name: App Scopes Expanded Same Scopes
ExpectedResult: false
Log:
{
"action": "app_scopes_expanded",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "A012B3CDEFG",
"name": "username",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace",
"id": "T01234N56GB",
"name": "test-workspace",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"date_create": "2022-07-28 16:48:14",
"details":
{
"granular_bot_token": true,
"is_internal_integration": false,
"is_token_rotation_enabled_app": false,
"new_scopes":
[
"chat:write",
"im:write",
"links:read",
"links:write",
"users:read",
"files:write",
"reactions:read"
],
"previous_scopes":
[
"chat:write",
"im:write",
"links:read",
"links:write",
"users:read",
"files:write",
"reactions:read"
],
},
"entity":
{
"type": "workspace",
"workspace":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
},
},
"id": "9d9b76ce-47bb-4838-a96a-1b5fd4d1b564",
}
- Name: App Resources Added
ExpectedResult: true
Log:
{
"action": "app_resources_added",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "A012B3CDEFG",
"name": "username",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace",
"id": "T01234N56GB",
"name": "test-workspace",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"entity":
{
"type": "workspace",
"workspace":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
},
},
"id": "72cac009-9eb3-4dde-bac6-ee49a32a1789",
}
- Name: App Resources Granted
ExpectedResult: true
Log:
{
"action": "app_resources_granted",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "A012B3CDEFG",
"name": "username",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace",
"id": "T01234N56GB",
"name": "test-workspace",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"date_create": "2022-07-28 16:48:14",
"details":
{
"export_end_ts": "2022-07-28 09:48:12",
"export_start_ts": "2022-07-27 09:48:12",
"export_type": "STANDARD",
},
"entity":
{
"type": "workspace",
"workspace":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
},
},
"id": "9d9b76ce-47bb-4838-a96a-1b5fd4d1b564",
}
- Name: Bot Token Upgraded
ExpectedResult: true
Log:
{
"action": "bot_token_upgraded",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "A012B3CDEFG",
"name": "username",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace",
"id": "T01234N56GB",
"name": "test-workspace",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"entity":
{
"type": "workspace",
"workspace":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
},
},
"id": "72cac009-9eb3-4dde-bac6-ee49a32a1789",
}
- Name: User Logout
ExpectedResult: false
Log:
{
"action": "user_logout",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"date_create": "2022-07-28 15:22:32",
"entity":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "T01234N56GB",
},
},
"id": "72cac009-9eb3-4dde-bac6-ee49a32a1789",
}
# ------ paired body: slack_app_access_expanded.py ------
from panther_slack_helpers import slack_alert_context
ACCESS_EXPANDED_ACTIONS = [
"app_scopes_expanded",
"app_resources_added",
"app_resources_granted",
"bot_token_upgraded",
]
def rule(event):
if event.get("action") not in ACCESS_EXPANDED_ACTIONS:
return False
# Check to confirm that app scopes actually expanded or not
if event.get("action") == "app_scopes_expanded":
changes = get_scope_changes(event)
if not changes["added"]:
return False
return True
def title(event):
return (
f"Slack App [{event.deep_get('entity', 'app', 'name')}] "
f"Access Expanded by [{event.deep_get('actor', 'user', 'name')}]"
)
def alert_context(event):
context = slack_alert_context(event)
changes = get_scope_changes(event)
context["scopes_added"] = changes["added"]
context["scopes_removed"] = changes["removed"]
return context
def get_scope_changes(event) -> dict[str, list[str]]:
changes = {}
new_scopes = event.deep_get("details", "new_scopes", default=[])
prv_scopes = event.deep_get("details", "previous_scopes", default=[])
changes["added"] = [x for x in new_scopes if x not in prv_scopes]
changes["removed"] = [x for x in prv_scopes if x not in new_scopes]
return changes
def severity(event):
# Used to escalate to High/Critical if the app is granted admin privileges
# May want to escalate to "Critical" depending on security posture
if "admin" in event.deep_get("entity", "app", "scopes", default=[]):
return "High"
# Fallback method in case the admin scope is not directly mentioned in entity for whatever
if "admin" in event.deep_get("details", "new_scopes", default=[]):
return "High"
if "admin" in event.deep_get("details", "bot_scopes", default=[]):
return "High"
return "Medium"