Suspicious Non-Browser Network Communication With Telegram API

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•1•0•17

Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.