Medium RiskWindowsLegitimateCommonly Abused
slack.exeCOMMUNICATION APPslack.exe - Slack Communication App Security Analysis
slack.exe is the **Slack workplace communication** desktop client. Attackers target Slack for **token theft**, **data exfiltration** via webhooks, and **malware distribution** through shared files. Slack's API can be abused for **C2 communication** over trusted channels.
Risk Summary
MEDIUM priority for SOC triage. slack.exe is a legitimate communication app that can be abused for C2 and data exfiltration. Monitor for Slack token theft, webhook abuse, and Slack API calls from non-Slack processes.
Overview
What is slack.exe?
Slack is a workplace communication platform.
Core Functions
Communication:
- Team messaging
- File sharing
- Integrations/bots
- Webhooks
Security Significance
- Token Value: Access to corporate data
- Webhook Abuse: C2 via webhooks
- Data Exfil: File sharing for exfil
- Electron-Based: JS injection risks
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | %LOCALAPPDATA%\slack\slack.exe |
| Parent | explorer.exe |
| User | Logged-in user |
| Network | slack.com |
Token Location
%APPDATA%\Slack\storage\
Common Locations
C:\Users\*\AppData\Local\slack\slack.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: %LOCALAPPDATA%\slack\slack.exe
Network: slack.com
Behavior: Normal messaging
SUSPICIOUS
Path: C:\Temp\slack.exe
Behavior: Token files accessed by other process
Webhook POST from non-Slack process
Abuse Techniques
Attack Techniques
Technique #1: Token Theft (T1528)
Stealing Slack authentication tokens.
Technique #2: Webhook C2 (T1102)
C2 via Slack Webhooks:
POST /services/T.../B.../...
Technique #3: Data Exfiltration (T1567)
Exfiltrating data via file uploads.
Detection Guidance
Detection Strategies
Priority #1: Token Access
Process != "slack.exe" AND
FileAccess CONTAINS "Slack\storage"
→ ALERT: HIGH - Token theft
Priority #2: Non-Slack Webhook Traffic
Process != "slack.exe" AND
Network = "hooks.slack.com"
→ ALERT: HIGH - C2 via Slack
Remediation Steps
Protection and Remediation
Defense: Monitor Integrations
Review Slack app integrations regularly.
If Compromise Suspected
- Revoke active sessions
- Rotate workspace tokens
- Audit integrations
- Review message history
Investigation Checklist
Investigation Checklist
- Verify slack.exe path
- Check for token file access
- Review webhook activity
- Audit integrations
MITRE ATT&CK Techniques
Last verified: January 18, 2026