Possible Stealer Exfiltration to Telegram Bot API (api.telegram.org) from Unsigned/Scripting Host - Aurora/BlueNoroff
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Suricata
