HEAVYGRAM Telegram Bot Remote Command Execution

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

This rule detects potentially malicious behavior involving the Python interpreter spawning command-line shells (cmd.exe or powershell.exe), or interactions (creation/modification) with a specific file at 'C:\ProgramData\ur.txt'. This behavior is often associated with post-exploitation activities, staging, or script-based execution of malicious payloads.