SlackWorkspaces

​

Overview

​

Syntax

Seatbelt.exe SlackWorkspaces

​

Output

• Workspace names and IDs
• Workspace URLs (e.g., company-name.slack.com)
• Team names and domains
• User email addresses associated with workspaces
• Last access timestamps
• Authentication token presence indicators

​

Use Cases

​

Red Team

• Organization Identification: Discover target organization’s Slack workspace URLs
• User Enumeration: Identify email addresses and usernames
• Phishing Preparation: Craft targeted phishing using workspace information
• Credential Access: Locate authentication tokens for workspace access
• Reconnaissance: Map organizational structure from workspace names

​

Blue Team

• Shadow IT Detection: Identify unauthorized Slack workspaces
• Access Audit: Review workspace memberships and access patterns
• Compliance Monitoring: Ensure workspace usage aligns with policies
• Incident Response: Track workspace access during investigations
• Data Governance: Document organizational Slack usage

​

Example Output

====== SlackWorkspaces ======

User: john.doe

  Slack Workspaces  : C:\Users\john.doe\AppData\Roaming\Slack\storage\slack-workspaces

  Workspace
    Name              : Contoso Corporation
    Domain            : contoso.slack.com
    TeamId            : T01234ABCDE
    UserEmail         : john.doe@contoso.com
    UserId            : U56789FGHIJ
    LastAccess        : 2024-10-20 08:30:15

  Workspace
    Name              : Contoso IT Department
    Domain            : contoso-it.slack.com
    TeamId            : T98765ZYXWV
    UserEmail         : john.doe@contoso.com
    UserId            : U11111AAAAA
    LastAccess        : 2024-10-19 14:22:00

  Workspace
    Name              : Partner Network
    Domain            : partner-collab.slack.com
    TeamId            : T24680BDFHJ
    UserEmail         : jdoe@partners.com
    UserId            : U33333CCCCC
    LastAccess        : 2024-10-15 11:10:30

​

Privilege Context

• Non-Elevated: Parses Slack workspaces for the current user only
• Elevated: Parses Slack workspaces for ALL users on the system, providing comprehensive workspace discovery

​

Remote Execution

Seatbelt.exe SlackWorkspaces -computername=TARGET.domain.com -username=DOMAIN\user -password=pass

​

Detection Considerations

​

Indicators

• File system access to Slack storage directories
• Reading slack-workspaces files in AppData\Roaming\Slack
• Parsing LevelDB or JSON data structures
• Enumeration across multiple user profiles

​

Defensive Monitoring

• Monitor access to Slack storage directories by non-Slack processes
• Alert on automated enumeration of workspace data
• Track processes reading Slack workspace configuration
• Log bulk access to Slack storage across multiple users
• Detect reconnaissance tools accessing collaboration app data
• Monitor for exfiltration of workspace configuration files

​

What Slack Workspaces Reveal

• Organizational Slack workspace names and URLs
• User email addresses and identities
• Team structure and departmental workspaces
• External collaboration partnerships (partner workspaces)
• Multi-workspace usage patterns
• Phishing targets and social engineering vectors

​

Workspace Data Contains

• Workspace domain names (subdomain.slack.com)
• Team IDs and workspace identifiers
• User IDs and email addresses
• Authentication tokens (in some cases)
• Workspace membership information
• Access timestamps

​

Privacy Considerations

• Workspace data may reveal personal Slack usage
• Can expose external collaboration relationships
• May contain business-sensitive workspace names
• Consider user privacy when collecting workspace data

​

Related Commands

• SlackPresence: Checks for Slack installation and file presence
• SlackDownloads: Parses Slack download history
• azuread: Returns AzureAD information
• CloudCredentials: Finds cloud provider credentials
• dir: Lists files in user directories