Proxy HTTP GET to Telegram API with Small Sieve Indicators Potential C2

title: Proxy HTTP GET to Telegram API with Small Sieve Indicators Potential C2
id: 0bf763aa-a77f-4431-baec-31a477bfaaa6
status: test
description: This rule flags proxy web requests using HTTP GET to api.telegram.org where the request URI contains a specific chat_id and the text path prefix com/. Such traffic can indicate malware using Telegram as a command-and-control channel, where attackers embed commands or control data within normal-looking API calls. It relies on proxy telemetry capturing HTTP method, destination host, and URI contents including chat_id and the com/ prefix.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/proxy_malware_small_sieve_telegram_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    cs-host: api.telegram.org
    cs-uri|contains|all:
      - chat_id=2090761833
      - text=com/
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: b0422664-37a4-4e78-949a-4a139309eaf0
    type: derived