Telegram Bot API POST sendMessage C2 Exfiltration - python-requests/curl UA

Duo Tech@duotech

•updated Jul 1, 2026•0•0•1

This rule detects outbound POST requests to the Telegram Bot API (api.telegram.org) originating from internal network hosts. The detection specifically looks for requests containing the 'sendMessage' path, which is characteristic of bots transmitting stolen data (such as credentials) or command-and-control communication. It focuses on traffic initiated by common command-line tools like 'python-requests' or 'curl', which are frequently abused by automated malware scripts.