OTP Relay Admin Panel & Telegram C2 Traffic (Montana Empire Kit)
This rule identifies network traffic containing specific strings associated with known malicious command-and-control (C2) behavior, such as hardcoded PHP script names often used by web shells, connection attempts to Telegram API servers for exfiltration, and other identifiable strings often associated with threat actor interaction.
Cortex XDR
