Bidirectional C2 via Telegram Bot API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects bidirectional Command and Control (C2) communication utilizing the Telegram Bot API. It specifically looks for HTTP traffic where the host is 'api.telegram.org' and the URI contains '/bot'. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives.