From 432a727f411730061c6820f0ad229ec1fd827a2e Mon Sep 17 00:00:00 2001 From: Thomas Stromberg Date: Fri, 14 Oct 2022 10:22:50 -0400 Subject: [PATCH] Add Slack Technologies signature --- detection/c2/unexpected-talkers-macos.sql | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detection/c2/unexpected-talkers-macos.sql b/detection/c2/unexpected-talkers-macos.sql index 074d141..c15dab1 100644 --- a/detection/c2/unexpected-talkers-macos.sql +++ b/detection/c2/unexpected-talkers-macos.sql @@ -207,8 +207,10 @@ WHERE '443,6,500,Reflect Helper,app.reflect.ReflectDesktop,Developer ID Application: Reflect App, LLC (789ULN5MZB)', '443,6,500,sample,com.apple.dt.SamplingTools.sample,Software Signing', '443,6,500,scorecard-darwin-amd64,,', + -- Why so many Slack signatures? We may never know. '443,6,500,Slack Helper,,', '443,6,500,Slack Helper,com.tinyspeck.slackmacgap.helper,Apple Mac OS Application Signing', + '443,6,500,Slack Helper,com.tinyspeck.slackmacgap.helper,Developer ID Application: Slack Technologies, Inc. (BQR82RBBHL)'', '443,6,500,steam_osx,com.valvesoftware.steam,Developer ID Application: Valve Corporation (MXGJJ98X76)', '443,6,500,step,step,', '443,6,500,syft,syft,Developer ID Application: ANCHORE, INC. (9MJHKYX5AT)',