Jingle Bell

Scenario

Jingle Bell is an easy difficulty Sherlock where you are presented with a set of Windows artefacts and must uncover the source of a leak within Forela’s corporate environment.

Executive Summary

An insider at Forela used the Slack desktop client to trade company secrets with a contact at a rival firm. The conversation ran in a dedicated channel, where the rival’s representative coordinated which files to steal, supplied an archive password, and later shared a cloud-storage folder for the upload. Once the data was handed over, the rival confirmed payment in the same channel. None of the Slack content survived locally in the usual places, but every message that raised a Windows toast was preserved in the notification database, which gave the whole exchange in readable form.

Artifacts

• wpndatabase.db: Appdata/Local/Microsoft/Windows/Notifications/wpndatabase.db → open with sqlite3. The Notification table holds the raw toast XML in Payload and a Windows arrival time per row
• wpndatabase.db-wal / wpndatabase.db-shm: the write-ahead log and shared memory file. Copy all three together so the WAL merges when the database is opened; recent toasts live there

Timestamp note: The ArrivalTime column is when Windows raised the toast, not when the message was sent. Q7 needs the Slack message timestamp embedded in the toast’s launch URL instead.

Exfiltration

Copy the three database files into a scratch directory and dump the Notification table. The launch attribute of the toast XML is a slack://channel?... protocol URL, and every toast shares the same app header, so the leak ran through the Slack desktop client.

cp wpndatabase.db* work/db/ && sqlite3 work/db/wpndatabase.db "select * from Notification" > work/notif.txt

grep -o 'launch="[a-z]*://' work/notif.txt | sort | uniq -c

Each toast carries a <header> element whose title is the Slack workspace the message came from. Every message in the conversation sits under the same workspace, which is the rival organisation’s.

grep -o '<header id="[A-Z0-9]*" title="[^"]*"' work/notif.txt | sort | uniq -c

The body text of a Slack toast is prefixed with the sender’s display name. Reading the PrimeTech toasts, the other party opens by asking Torrin whether the Forela files have been found, so the prefix on those messages is the contact’s username.

grep -o 'hint-wrap="true">[^:]*:' work/notif.txt | sort | uniq -c

The first text element of a channel toast reads New message in #<channel>. The toasts that carry the file requests and the credentials all show the same channel, while the earlier ones are direct messages (different id=D... values in the launch URL).

grep -o 'New message in #[^<]*' work/notif.txt | sort | uniq -c

From Q4 the conversation is in the leak channel, so read the toasts there in order. The message at notification id 277 hands over the archive server password on its own line in the toast body, copied from the Payload as is.

grep -n -B3 -A3 'Tobdaf' work/notif.txt

Gotcha: The password contains $ and @. Quote it in single quotes if you pipe it through a shell, or the shell will expand part of it.

Continuing through the channel toasts after the password, notification id 280 contains a Google Drive folder share link. That is where the stolen data was to be uploaded.

grep -o 'https://drive.google.com[^<]*' work/notif.txt

From Q6 the link is in the toast for notification id 280. Its launch URL has a message= parameter, which is the Slack message timestamp as epoch seconds: 1681986889. Convert that to UTC for the time the message was sent.

date -u -d @1681986889 '+%Y-%m-%d %H:%M:%S'

Gotcha: The database ArrivalTime for the same row is 10:36:08, roughly 79 seconds later than the message. That is when the toast was raised on Torrin’s machine, not when the link was shared, and it is not accepted as the answer.

The last toast in the channel, notification id 281, is the rival confirming payment: a message saying the amount was sent to the account shared earlier. The amount in the text is 10,000 £, which has to be rewritten to the £XXXXXX format.

grep -n 'Sent ' work/notif.txt

Gotcha: The toast writes the currency symbol after the number with a comma separator. The answer format wants the symbol first and no comma.

Attack Summary

Phase	Action
Collection	Rival contact asks Torrin, via Slack, for the Forela extraction plan files
Collection	Archive server password shared in the leak channel
Exfiltration	Google Drive folder link shared as the upload destination
Exfiltration	Torrin hands the data over
Exfiltration	Rival confirms payment of £10000 in the channel

Forensic Timeline

Timestamp	Event
2023-04-20 10:09:09	First PrimeTech toast arrives (direct message)
2023-04-20 10:32:24	Toast carrying the archive server password arrives
2023-04-20 10:34:49	Slack message sharing the Drive upload link is sent
2023-04-20 10:36:08	Toast for that message arrives in the notification database
2023-04-20 10:38:19	Toast confirming the £10000 payment arrives

IOCs

Type	Value
Slack workspace	PrimeTech Innovations (team T054518ADUJ)
Slack user	Cyberjunkie-PrimeTechDev
Slack channel	#forela-secrets-leak
URL	hxxps[://]drive[.]google[.]com/drive/folders/1vW97VBmxDZUIEuEUG64g5DLZvFP-Pdll?usp=sharing
Credential	Tobdaf8Qip$re@1

MITRE ATT&CK

Technique	ID	Description
Exfiltration Over Web Service	T1567	Stolen data passed to the rival through Slack and a shared link
Exfiltration to Cloud Storage	T1567.002	Upload destination was a Google Drive folder
Data from Cloud Storage	T1530	Insider-sourced Forela material gathered for hand-off

Defender Takeaways

Personal and unsanctioned chat clients are an exfiltration path. A Slack workspace belonging to another company was reachable from a Forela endpoint. Restrict desktop messaging apps to approved workspaces and alert on connections to unknown ones.

Public cloud-storage links are a standard upload channel. The upload target was a plain Google Drive share link. Proxy or CASB controls that block uploads to non-corporate Drive tenants would have closed it.

The notification database keeps message content after the app is cleaned. wpndatabase.db held sender names, channel names, a password and a payment confirmation in cleartext. Include it in endpoint triage collections, and remember to collect the WAL and SHM files with it.

Treat toast timestamps and message timestamps as different clocks. The arrival time in the database trails the message by over a minute here. Take the Slack epoch from the launch URL when a message time matters.

Conclusion

A Forela insider sold internal material to a competitor over Slack and was paid £10000, and the entire exchange was recoverable from a single Windows notification database. Users cannot hide a chat from wpndatabase.db once a toast has fired.