Ephemeral Go-Build Binary Network Connection to Slack API

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects network connections to the Slack API (api.slack.com) initiated by processes executing from temporary directories commonly used by the Go build system ('go-build'). This pattern is indicative of a second-stage RAT or malicious payload compiled on-the-fly using 'go run' or similar mechanisms, utilizing Slack's infrastructure for C2 communication.