Windows Suspicious Non-Browser Network Traffic to api.telegram.org
Alerts on Windows network connections to api.telegram.org by processes other than common web browsers.
- Product
- windows
- Category
- network_connection
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-19
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags outbound network connections from processes on Windows whose destination contains api.telegram.org when the initiating process is not one of several known browser and web-view executables. Attackers commonly use messaging APIs like Telegram to blend into normal traffic while acting as command-and-control or for data transfer. It relies on Windows network connection telemetry and process image path information to exclude typical browser activity.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious Non-Browser Network Traffic to api.telegram.org
id: 76c50d5a-6fee-4e4f-9eed-7a41ec624eab
status: test
description: This rule flags outbound network connections from processes on Windows whose destination contains api.telegram.org when the initiating process is not one of several known browser and web-view executables. Attackers commonly use messaging APIs like Telegram to blend into normal traffic while acting as command-and-control or for data transfer. It relies on Windows network connection telemetry and process image path information to exclude typical browser activity.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
- attack.command-and-control
- attack.exfiltration
- attack.t1102
- attack.t1567
- attack.t1105
logsource:
product: windows
category: network_connection
detection:
selection:
DestinationHostname|contains: api.telegram.org
filter_main_brave:
Image|endswith: \brave.exe
filter_main_chrome:
Image:
- C:\Program Files\Google\Chrome\Application\chrome.exe
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
filter_main_firefox:
Image:
- C:\Program Files\Mozilla Firefox\firefox.exe
- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
filter_main_ie:
Image:
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
- C:\Program Files\Internet Explorer\iexplore.exe
filter_main_maxthon:
Image|endswith: \maxthon.exe
filter_main_edge_1:
- Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
- Image|endswith: \WindowsApps\MicrosoftEdge.exe
- Image:
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- C:\Program Files\Microsoft\Edge\Application\msedge.exe
filter_main_edge_2:
Image|startswith:
- C:\Program Files (x86)\Microsoft\EdgeCore\
- C:\Program Files\Microsoft\EdgeCore\
Image|endswith:
- \msedge.exe
- \msedgewebview2.exe
filter_main_opera:
Image|endswith: \opera.exe
filter_main_safari:
Image|endswith: \safari.exe
filter_main_seamonkey:
Image|endswith: \seamonkey.exe
filter_main_vivaldi:
Image|endswith: \vivaldi.exe
filter_main_whale:
Image|endswith: \whale.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS etc.
level: medium
license: DRL-1.1
related:
- id: c3dbbc9f-ef1d-470a-a90a-d343448d5875
type: derived