Slack Messages Harvested for Credential Tokens

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•6

This rule detects attempts to harvest Slack messages for credential tokens by monitoring HTTP requests to slack.com with the URI '/conversations.history'. A threshold of 20 such requests within 60 seconds from the same source IP triggers the alert, indicating potential automated data exfiltration or reconnaissance.