Archived data exfiltrated to Telegram Bot API C2
This rule detects potential data exfiltration by monitoring for the creation of zip archives followed by an network connection to Telegram's API by the same device within a 10-minute window. This behavior often indicates that a user or an attacker is staging data in an archive and subsequently uploading it to a cloud file-sharing service.
Microsoft Sentinel (KQL)
