CARBONATO Hermes Agent Telegram C2 Egress to api.telegram.org

Ibrahim Saud@tektrix

•updated 29 days ago•0•0•0

This rule detects network traffic originating from internal hosts directed to the Telegram API endpoint 'api.telegram.org' with a URI pattern associated with bot interaction, potentially indicating usage of a Telegram-based Command and Control (C2) mechanism by the CARBONATO/Hermes agent.