Slack API Used as Bidirectional C2 Channel
This rule detects the use of the Slack API for potential bidirectional command and control (C2) communication. Specifically, it looks for HTTP traffic to 'slack.com' that includes the '/api/chat.postMessage' URI. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives, indicating a high frequency of message posting activity which could be indicative of automated C2.
Suricata
