Webhooks for C2 (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.