Data Exfiltrated via Slack Incoming Webhook

Darshan Thummar@Mighty

•updated Jun 12, 2026•1•0•6

This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.