BQTLock Telegram Bot API C2 from Non-Browser Process (T1102/T1071.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects network communication with the Telegram API endpoints (api.telegram.org) originating from processes other than common web browsers. The rule specifically monitors DNS queries, network connections via Sysmon, and proxy/firewall logs for requests involving common Telegram bot API methods (getUpdates, sendMessage, sendPhoto, setWebhook). It also flags execution patterns associated with specific tools (e.g., PyInstaller, bqt.exe, start.exe) that may indicate automated C2 activity.