Proxy HTTP GET to api.telegram.org with chat_id and text com/ (Small Sieve C2 behavior)
Alerts on proxy HTTP GET requests to api.telegram.org containing a specific chat_id and com/ prefix consistent with C2 behavior.
FreeReviewedSigma · Critical · v5
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-19
- Updated
- 2026-07-31
What it detects
This rule flags proxy traffic matching an HTTP GET request to api.telegram.org where the query string contains a specific chat_id value and a text parameter beginning with "com/". Such patterns can indicate malware using Telegram as a command-and-control channel for sending or retrieving instructions. The detection relies on proxy logs capturing HTTP method, destination host, and full request URI query parameters.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-http-get-to-telegram-api-with-small-sieve-indicators-potential-c2-b0422664
title: Proxy HTTP GET to api.telegram.org with chat_id and text com/ (Small Sieve C2 behavior)
id: 0bf763aa-a77f-4431-baec-31a477bfaaa6
status: test
description: This rule flags proxy traffic matching an HTTP GET request to api.telegram.org where the query string contains a specific chat_id value and a text parameter beginning with "com/". Such patterns can indicate malware using Telegram as a command-and-control channel for sending or retrieving instructions. The detection relies on proxy logs capturing HTTP method, destination host, and full request URI query parameters.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/proxy_malware_small_sieve_telegram_communication.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: GET
cs-host: api.telegram.org
cs-uri|contains|all:
- chat_id=2090761833
- text=com/
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: b0422664-37a4-4e78-949a-4a139309eaf0
type: derived