Unc1069 Telegram Bot Exfil

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•2•0•38

This rule detects HTTP network connections to the Telegram bot API (api.telegram.org/bot). This pattern is often associated with infostealers exfiltrating data to attacker-controlled Telegram bots. The rule specifically looks for the 'NETWORK_HTTP' event type and a URL containing '/api.telegram.org/bot' (case-insensitive).