Slack service owner transferred
Description
AlphaSOC detected a transfer of Slack service ownership. This action changes the primary ownership of a Slack workspace or organization to another user, granting them full administrative privileges.
Impact
A service owner transfer grants the new owner complete administrative access to the Slack workspace, including user management, data access, and workspace settings. Adversaries can exploit this to maintain persistent access, exfiltrate sensitive communications, or disrupt business operations.
Severity
| Severity | Condition |
|---|---|
Medium | Slack service owner transferred |
Investigation and Remediation
Review Slack audit logs to identify the previous and new owners and verify if the transfer received proper authorization and documentation. For unauthorized transfers, contact Slack support to reverse the ownership change, reset credentials for affected administrators, review workspace settings and third-party integrations, and audit recent changes made by the unauthorized owner.