FLATROOF C2 via attacker webhook, Telegram Bot API and GitHub API from non-brows
Detects network activity involving a specific suspicious webhook domain or URL path alongside connections to legitimate external services (such as Telegram or GitHub API) from non-standard processes on the same device, which may indicate command and control (C2) or data exfiltration behavior.
Microsoft Sentinel (KQL)
