It's baked into the protocol. A single validator can cryptographically prove that some other validator did something not allowed, and generate a special transaction that slashes that validator and gives you some ETH as a reward.

A common misconception here is that slashing happens based on what transactions you include or not. False. Slashing happens because of things such as proposing or attesting twice.