Telegram API Connection by Non-Browser or Telegram Process
This rule detects network connections to the Telegram API (api.telegram.org) originating from processes that are not recognized as legitimate Telegram applications (e.g., chrome.exe, Telegram.exe). This behavior can indicate the presence of malware or other unauthorized applications attempting to exfiltrate data or establish command and control via the Telegram messaging platform.
Cortex XDR
