feat(corpus): add Slack SaaS-collaboration platform (3 red↔blue pairs)

[Gerrrt]

What

Adds the Slack platform — the SaaS-collaboration seam — as 3 companion-only red↔blue pairs over the Slack (Enterprise Grid) audit logs (product: slack, field action):

Attack (red)	Detection (blue)	ATT&CK
slack-malicious-app — install a broad-scope OAuth app for durable message/file access	slack-app-audit — app_installed	T1098
slack-external-share — invite an attacker-controlled workspace into a channel via Slack Connect to exfil its history	slack-external-share-audit — shared_channel_invite_sent / _accepted	T1567
slack-2fa-disable — turn off enforced 2FA to weaken workspace auth	slack-2fa-audit — pref.two_factor_auth_changed with 2FA off	T1562.001

Corpus is now 71 paired concepts + 1 unpaired recon entry.

Why

Opens the collaboration/messaging seam distinct from the CI/CD and registry rounds — three different tactics (Persistence, Exfiltration, Defense Evasion) over a single Slack audit logsource.

Notes

• Companion-only SaaS pairs — no companion:gen markers, nothing generates into the flat views.
• Slack 2FA enforcement is an org-settings action (no public API), so that red entry presents the console step honestly; app-token exchange and conversations.inviteShared use real Slack API methods.
• CI-verified locally: bash -n, pairing graph + slot coverage, gen-views.sh --check.

🤖 Generated with Claude Code

https://claude.ai/code/session_011spYcGfeP4a3RNQQVDrGtW

---

Generated by Claude Code

[Copilot]

Pull request overview

Adds Slack (Enterprise Grid) as a new SaaS collaboration seam in the companion corpus by introducing three new red↔blue paired concepts backed by Slack audit-log action telemetry, and updates top-level docs to reflect the expanded corpus size.

Changes:

• Add 3 new Slack red entries (malicious OAuth app install, Slack Connect external share, org-wide 2FA enforcement disable).
• Add 3 corresponding Slack blue audit detections with Splunk-style example queries.
• Update README + CHANGELOG to include Slack and bump the corpus count from 68 to 71 paired concepts.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates corpus count and adds Slack rows to the corpus pairing table.
CHANGELOG.md	Documents the new Slack platform seam and updates the corpus count.
entries/red/slack-malicious-app.md	New red entry for persistence via broad-scope Slack OAuth app installation.
entries/red/slack-external-share.md	New red entry for exfiltration via Slack Connect shared channel invites.
entries/red/slack-2fa-disable.md	New red entry for defense evasion by disabling enforced 2FA.
entries/blue/slack-app-audit.md	New blue detection for app_installed audit events.
entries/blue/slack-external-share-audit.md	New blue detection for shared-channel invite audit events.
entries/blue/slack-2fa-audit.md	New blue detection for 2FA enforcement disable audit events.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.