Slack workspace C2 relay: TLS connections to actor-controlled Slack subdomains

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.