How do you detect C2 over legitimate services like Telegram or GitHub?

Because you usually cannot block trusted SaaS (Telegram, Slack, Discord, GitHub, Dropbox, Pastebin), detect abuse by context rather than destination. Join network egress to the originating process via EDR and alert when a non-browser/non-app process (e.g. powershell.exe or an unknown binary) calls these APIs. Apply beacon-timing analysis to dead-drop polling (GitHub raw, Pastebin, Drive), hunt bot tokens and webhook URLs with secret-scanning, and flag first-seen callers and steady small requests from hosts not interactively using the service.

Detecting C2 over Legitimate Services (Slack, Telegram, GitHub)

Attackers increasingly use trusted web services as C2 dead-drops and channels: Telegram bots, Slack/Discord webhooks, GitHub repos and Gists, Dropbox/Google Drive and Pastebin (T1102). The destinations are reputable, so detection moves to context: which process is calling the API, from which host, and whether the pattern looks like automation rather than a human.

Signals at a Glance

Service abuse	Signal	ATT&CK
Telegram bot API from non-browser process	api.telegram.org calls by odd process	T1102.002
Slack/Discord webhook from a server/workstation	hooks.slack.com / discord webhook egress	T1102.002
GitHub/Gist dead-drop polling	Periodic raw.githubusercontent fetches	T1102.001
Dropbox/Drive API by unexpected process	content.dropboxapi.com by non-sync app	T1102.002
Pastebin raw polling on a schedule	pastebin.com/raw beaconing	T1102.001

Process and Host Context

The key question is not the destination but the caller. A workstation's browser talking to Telegram is normal; powershell.exe or an unknown binary doing it is not. Join egress to the originating process via EDR:

// KQL: non-browser process reaching common C2-capable SaaS APIs
DeviceNetworkEvents
| where RemoteUrl has_any ("api.telegram.org","hooks.slack.com","discord.com/api/webhooks",
                          "raw.githubusercontent.com","pastebin.com/raw","content.dropboxapi.com")
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","slack.exe","teams.exe")
| summarize hits=count(), urls=make_set(RemoteUrl, 5)
          by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where hits > 5

Automation vs Human

Periodicity: dead-drop polling (GitHub/Pastebin/Drive) beacons on a schedule — apply beacon-timing analysis to SaaS egress too.
Token artifacts: hunt Telegram bot tokens and webhook URLs in process memory, scripts and command lines.
First-seen caller: a server or workstation process that has never used a given SaaS API suddenly doing so is worth a look.
Volume mismatch: steady small requests to a messaging/file API from a host that is not interactively using it.

Vetted sources

You generally cannot block these domains, so lean on EDR process-to-network joins, beacon-timing on SaaS egress and secret-scanning for bot tokens/webhook URLs. SigmaHQ has rules for suspicious processes contacting messaging APIs. Baseline which processes legitimately use each service in your environment.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Process and Host Context

Automation vs Human

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Domain Fronting Detection