Small Sieve Malware Telegram C2 Communication

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•34

Detects potential Command and Control (C2) communication associated with the Small Sieve malware. This rule specifically looks for HTTP GET requests to 'api.telegram.org' with a specific chat_id and 'text=com/' in the URI, which are indicators of Small Sieve's use of the Telegram Bot API for C2.