Slack Authentication From Unrecognised Source Address

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a Slack login from a source address without prior history for that account. A compromised Slack account gives an attacker the organisation's informal channel — where credentials, links and internal detail are shared far more freely than in email — and is an effective base for internal phishing. Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833). Integration guide: https://bloo.io/docs/integrations/slack BQL (Bloo Query Language): stream=authentication where sourcename='SLACK' and action='LOGIN' | groupby user, srcip, authproto, reason