Potential Telegram API Request Via Command Line

This analytic detects the presence of "api.telegram.org" in the command line of a process. This activity is significant because the Telegram API has been used as an exfiltration mechanism or as a Command and Control (C2) channel by adversaries. If confirmed malicious, this could indicate an attacker or malware is exfiltrating data or receiving additional C2 instructions, potentially leading to further compromise and persistence within the network. The rule leverages process execution logs from Endpoint Detection and Response (EDR) agents.