HEAVYGRAM PowerShell Implant Polling Telegram getUpdates C2 Endpoint

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•1

Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.