Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Linux Telegram API Request

This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior.

ATT&CK coverage

Outside the enterprise matrix

T1071Application Layer Protocol 112 detections cover this technique
T1071.001Web Protocols 77 detections cover this technique
T1102Web Service 35 detections cover this technique
T1102.002Bidirectional Communication 15 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

Tagged by the source as

Data Source: Auditd ManagerData Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: SentinelOneDomain: EndpointOS: LinuxResources: Investigation GuideTactic: Command and ControlUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.