Telegram Bot API getUpdates polling used as C2 channel

Duo Tech@duotech

•updated Jul 2, 2026•1•0•5

This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.