Skip to content

Slack Webhook

Service Name: Slack

Service Description: Slack is a business communication platform that offers many IRC-style features, including persistent chat rooms (channels) organized by topic, private groups, and direct messaging.

Service Address: https://slack.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants ability to post messages to specific Slack channels via webhook integration.

Secret Revokement URL: https://slack.com/apps/manage

Secret Example: https://hooks.slack.com/services/T01234567/B01234567/abcdefghijklmnopqrstuvwx

Suspicious Activity Investigation Instructions:

  • Check Slack channel for unauthorized messages or unusual posting patterns.
  • Review Slack workspace audit logs for webhook creation or modification.
  • Examine the content of messages sent via the webhook for malicious links or content.
  • Verify if the webhook has been used from unusual IP addresses or locations.

Mitigation Instructions:

  • Navigate to your Slack workspace settings.
  • Go to the Apps section and find the webhook integration.
  • Delete the compromised webhook or regenerate a new webhook URL.
  • Review other integrations for potential compromise.
  • Consider implementing IP restrictions for Slack API access if available.