AnalysisType: rule
Filename: slack_app_added.py
RuleID: "Slack.AuditLogs.AppAdded"
DisplayName: "Slack App Added"
Enabled: true
LogTypes:
- Slack.AuditLogs
Tags:
- Slack
- Persistence
- Server Software Component
Reports:
MITRE ATT&CK:
- TA0003:T1505
Severity: Medium
Description: Detects when a Slack App has been added to a workspace
Reference: https://slack.com/intl/en-gb/help/articles/202035138-Add-apps-to-your-Slack-workspace
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
- p_any_ip_addresses
- p_any_emails
Tests:
- Name: App added to workspace - Admin not in app scopes
ExpectedResult: true
Log:
{
"action": "app_installed",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "E012MH3HS94",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-panther-1",
"id": "T01770N79GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Go-http-client/2.0",
},
"date_create": "2021-06-08 22:16:15",
"details":
{
"is_internal_integration": false,
"is_token_rotation_enabled_app": false,
},
"entity":
{
"app":
{
"id": "A049JV0H0KC",
"is_directory_approved": true,
"is_distributed": true,
"name": "Notion",
"scopes":
[
"channels:history",
"channels:read",
"chat:write",
"groups:read",
"groups:write",
"im:read",
"mpim:read",
"groups:history",
"im:history",
"mpim:history",
],
},
"type": "app",
},
}
- Name: App Approved
ExpectedResult: true
Log:
{
"action": "app_installed",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "E012MH3HS94",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-panther-1",
"id": "T01770N79GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Go-http-client/2.0",
},
"date_create": "2021-06-08 22:16:15",
"details":
{ "app_owner_id": "W012J3AEWAU", "is_internal_integration": true },
"entity":
{
"app":
{
"id": "A012F34BFEF",
"is_directory_approved": false,
"is_distributed": false,
"name": "app-name",
"scopes": ["admin"],
},
"type": "app",
},
}
- Name: App Installed
ExpectedResult: true
Log:
{
"action": "app_installed",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "E012MH3HS94",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-panther-1",
"id": "T01770N79GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Go-http-client/2.0",
},
"date_create": "2021-06-08 22:16:15",
"details":
{ "app_owner_id": "W012J3AEWAU", "is_internal_integration": true },
"entity":
{
"app":
{
"id": "A012F34BFEF",
"is_directory_approved": false,
"is_distributed": false,
"name": "app-name",
"scopes": ["admin"],
},
"type": "app",
},
}
- Name: App added to workspace
ExpectedResult: true
Log:
{
"action": "app_installed",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "E012MH3HS94",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-panther-1",
"id": "T01770N79GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Go-http-client/2.0",
},
"date_create": "2021-06-08 22:16:15",
"details":
{ "app_owner_id": "W012J3AEWAU", "is_internal_integration": true },
"entity":
{
"app":
{
"id": "A012F34BFEF",
"is_directory_approved": false,
"is_distributed": false,
"name": "app-name",
"scopes": ["admin"],
},
"type": "app",
},
}
- Name: User Logout
ExpectedResult: false
Log:
{
"action": "user_logout",
"actor":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "T01234N56GB",
},
},
"context":
{
"ip_address": "1.2.3.4",
"location":
{
"domain": "test-workspace-1",
"id": "T01234N56GB",
"name": "test-workspace-1",
"type": "workspace",
},
"ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36",
},
"date_create": "2022-07-28 15:22:32",
"entity":
{
"type": "user",
"user":
{
"email": "user@example.com",
"id": "W012J3FEWAU",
"name": "primary-owner",
"team": "T01234N56GB",
},
},
"id": "72cac009-9eb3-4dde-bac6-ee49a32a1789",
}
# ------ paired body: slack_app_added.py ------
from panther_slack_helpers import slack_alert_context
APP_ADDED_ACTIONS = [
"app_approved",
"app_installed",
"org_app_workspace_added",
]
def rule(event):
return event.get("action") in APP_ADDED_ACTIONS
def title(event):
return (
f"Slack App [{event.deep_get('entity', 'app', 'name')}] "
f"Added by [{event.deep_get('actor', 'user', 'name')}]"
)
def alert_context(event):
context = slack_alert_context(event)
context["scopes"] = event.deep_get("entity", "app", "scopes")
return context
def severity(event):
# Used to escalate to High/Critical if the app is granted admin privileges
# May want to escalate to "Critical" depending on security posture
if "admin" in event.deep_get("entity", "app", "scopes", default=[]):
return "High"
# Fallback method in case the admin scope is not directly mentioned in entity for whatever
if "admin" in event.deep_get("details", "new_scopes", default=[]):
return "High"
if "admin" in event.deep_get("details", "bot_scopes", default=[]):
return "High"
return "Medium"