PowerShell Telegram Bot Check-in Beacon with 'is online' Text

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.