Detection rules › Sublime MQL

Sublime MQL rules: dlp

Rule	Severity
DLP: Slack Token	`high`

DLP: Slack Token

Severity: high
Type: dlp
Source: github.com/sublime-security/sublime-rules

Detects messages containing Slack API tokens and webhooks.

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
subject
type

Rule Body

type.outbound
and any([body.current_thread.text, subject.subject],
        // Slack tokens: xoxb-, xoxp-, xoxa-, xoxr-
        regex.contains(., '\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b')
        // Slack webhook URLs
        or regex.contains(., 'hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}')
)

Detection Logic

Scope: outbound message.

Detects messages containing Slack API tokens and webhooks.

outbound message
any([body.current_thread.text, subject.subject], // Slack tokens: xoxb-, xoxp-, xoxa-, xoxr- regex.contains(., '\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b') // Slack webhook URLs or regex.contains(., 'hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}') )

Inspects: body.current_thread.text, subject.subject, type.outbound. Sensors: regex.contains.

Indicators Matched (2)

Field	Match	Value
`regex.contains`	regex	`\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b`
`regex.contains`	regex	`hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}`

Stages and Predicates

Stage 1: `mql_rule`

and
  type.outbound eq "true"
   macro "any([body.current_thread.text, subject.subject],\n        // Slack tokens: xoxb-, xoxp-, xoxa-, xoxr-\n        regex.contains(., '\\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\\b')\n        // Slack webhook URLs\n        or regex.contains(., 'hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}')\n)"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.outbound`	eq	`true` transforms: `boolean` corpus 77 (mql 77)	`field:"type.outbound" kind:eq value:"true"`

Back to all Sublime MQL rules