Slack User Privileges Changed to User

AnalysisType: rule
Filename: slack_privilege_changed_to_user.py
RuleID: Slack.AuditLogs.UserPrivilegeChangedToUser
DisplayName: Slack User Privileges Changed to User
Enabled: true
LogTypes:
  - Slack.AuditLogs
Tags:
  - Slack
  - Impact
  - Account Access Removal
Reports:
  MITRE ATT&CK:
    - TA0040:T1531
Severity: Medium
Description: Detects when a Slack account is changed to User from an elevated role.
Reference: https://slack.com/intl/en-gb/help/articles/360018112273-Types-of-roles-in-Slack
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - p_any_ip_addresses
  - p_any_emails
Tests:
  - Name: Role Changed to User
    ExpectedResult: true
    Log:
      {
        "action": "role_change_to_user",
        "actor":
          {
            "type": "user",
            "user":
              {
                "email": "slack-enterprise-example@example.io",
                "id": "W015MH5MPGE",
                "name": "primary-owner",
                "team": "T017E0M3CQ4",
              },
          },
        "context":
          {
            "ip_address": "12.12.12.12",
            "location":
              {
                "domain": "example-workspace-domain",
                "id": "T017E0M3CQ4",
                "name": "example-workspace",
                "type": "workspace",
              },
            "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
          },
        "date_create": "2023-02-24 18:34:18",
        "entity":
          {
            "type": "user",
            "user":
              {
                "email": "example-account@example.com",
                "id": "U04R70MM40K",
                "name": "Example Account",
                "team": "T017E0M3CQ4",
              },
          },
        "id": "4c248a02-119c-4f76-ba5d-a96767d45be8",
      }
  - Name: Role Changed to Admin
    ExpectedResult: false
    Log:
      {
        "action": "role_change_to_admin",
        "actor":
          {
            "type": "user",
            "user":
              {
                "email": "slack-enterprise-example@example.io",
                "id": "W015MH5MPGE",
                "name": "primary-owner",
                "team": "T017E0M3CQ4",
              },
          },
        "context":
          {
            "ip_address": "12.12.12.12",
            "location":
              {
                "domain": "example-workspace-domain",
                "id": "T017E0M3CQ4",
                "name": "example-workspace",
                "type": "workspace",
              },
            "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
          },
        "date_create": "2023-02-24 18:33:21",
        "entity":
          {
            "type": "user",
            "user":
              {
                "email": "example-account@example.com",
                "id": "U04R70MM40K",
                "name": "Example Account",
                "team": "T017E0M3CQ4",
              },
          },
        "id": "1ad8fa51-f18e-450a-8e18-cfe31278be96",
      }


# ------ paired body: slack_privilege_changed_to_user.py ------

from panther_slack_helpers import slack_alert_context


def rule(event):
    return event.get("action") == "role_change_to_user"


def title(event):
    username = event.deep_get("entity", "user", "name", default="<unknown-entity>")
    email = event.deep_get("entity", "user", "email", default="<unknown-email>")

    return f"Slack {username}'s ({email}) role changed to User"


def alert_context(event):
    return slack_alert_context(event)