diff --git a/detection/c2/unexpected-talkers-macos.sql b/detection/c2/unexpected-talkers-macos.sql index 074d141..c15dab1 100644 --- a/detection/c2/unexpected-talkers-macos.sql +++ b/detection/c2/unexpected-talkers-macos.sql @@ -207,8 +207,10 @@ WHERE '443,6,500,Reflect Helper,app.reflect.ReflectDesktop,Developer ID Application: Reflect App, LLC (789ULN5MZB)', '443,6,500,sample,com.apple.dt.SamplingTools.sample,Software Signing', '443,6,500,scorecard-darwin-amd64,,', + -- Why so many Slack signatures? We may never know. '443,6,500,Slack Helper,,', '443,6,500,Slack Helper,com.tinyspeck.slackmacgap.helper,Apple Mac OS Application Signing', + '443,6,500,Slack Helper,com.tinyspeck.slackmacgap.helper,Developer ID Application: Slack Technologies, Inc. (BQR82RBBHL)'', '443,6,500,steam_osx,com.valvesoftware.steam,Developer ID Application: Valve Corporation (MXGJJ98X76)', '443,6,500,step,step,', '443,6,500,syft,syft,Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)',