huntrule

Suspicious Telegram API proxy access without Telegram User-Agent

Alerts on api.telegram.org requests where the User-Agent lacks common Telegram bot identifiers.

FreeReviewedSigma · Medium · v2
Category
proxy
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-06-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags proxy requests to api.telegram.org that match but do not include a User-Agent containing expected Telegram bot identifiers. Attackers may use the Telegram Bot API or related endpoints for command-and-control, blending in with normal network traffic. Detection relies on proxy telemetry fields for destination host and the client User-Agent string.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Malicious OilRig OAuth Application Sign-In via Azure (via azure)
Suspicious Whisper Backdoor Log File in Windows Temp
Suspicious Lunar Backdoor State File Creation via File System
Malicious FIN7 DiceLoader C2 via Placeholder User-Agent (via proxy)
Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)
Suspicious AddInProcess32 Outbound Connection after Process Hollowing
Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path
Suspicious RegAsm or AppLaunch Outbound Connection after Injection
Malicious FakeBat Distribution Domain Lookup (via dns_query)
Suspicious Telegram API proxy access without Telegram User-Agent
Pivot detection · T1071.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.