Possible Data Exfiltration via Telegram Bot API (T1567.004)

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•1

Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.