Phishing Link Delivered via Slack Message

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential phishing attempts delivered via Slack messages. It triggers when HTTP traffic to 'slack.com' contains '/messages/' in the URI, indicating a Slack message context, and has a threshold of 5 occurrences within 60 seconds from the same source.