How do you detect stealer exfiltration through Telegram bots?

Ask which process called api.telegram.org. Use Sysmon event 22 or EDR network telemetry to alert when any process other than Telegram or a browser resolves or connects to the Bot API, prioritising binaries in user-writable paths. With TLS inspection, match the /bot path and sendDocument or sendMessage calls. If the business does not use Telegram, block the domain and treat every blocked attempt as an infected host; otherwise allow it per process or device group.

Detecting Stealer Exfiltration via Telegram Bots

Many commodity stealers and clippers send their results through the Telegram Bot API: the sample holds a bot token and a chat ID and uploads a file or message to api.telegram.org. There is no operator-owned server to block, and the domain has a good reputation. Telegram sits under exfiltration over web services in ATT&CK, so we use the parent technique. Detection comes from asking which process made the call.

Signals at a Glance

Signal	Where	ATT&CK
DNS lookup of api.telegram.org by a process that is not Telegram or a browser	Sysmon 22, EDR network	T1567
HTTPS to api.telegram.org from a binary in a user-writable path	EDR network	T1567
URL path /bot...: sendDocument or sendMessage visible after TLS inspection	TLS-inspecting proxy	T1567
Host with no Telegram install or approved use contacting the API	Proxy, asset inventory	T1071.001
Recurring small sendMessage calls from one host (status or clipper beacons)	Proxy, flow	T1567

Process-Aware DNS and Network Hunting

Sysmon event 22 records the process behind each DNS query, which is exactly the field that turns an allowed domain into an alert:

index=sysmon EventCode=22 QueryName="api.telegram.org"
  NOT Image IN ("*\\Telegram.exe","*\\chrome.exe","*\\msedge.exe","*\\firefox.exe")
| stats count values(Image) AS processes earliest(_time) AS first latest(_time) AS last BY host, User
| sort - count
`comment("tune/validate: add sanctioned bots and automation by full image path")`

// Microsoft Defender (KQL) - same logic on network events, with a path filter
DeviceNetworkEvents
| where RemoteUrl has "api.telegram.org"
| where InitiatingProcessFileName !in~ ("telegram.exe","chrome.exe","msedge.exe","firefox.exe")
| extend UserWritable = InitiatingProcessFolderPath has_any ("\\AppData\\","\\Temp\\","\\ProgramData\\","\\Users\\Public\\")
| summarize conns=count(), first=min(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, UserWritable
| order by UserWritable desc, conns desc

Egress Policy

If the business does not use Telegram, block api.telegram.org at the proxy and DNS layer and alert on blocked attempts; each one names an infected host.
Where it is used, allow it by process or by device group, not for the whole estate.
With TLS inspection, match the /bot path prefix and the sendDocument method; capture the bot ID from the path to correlate hosts that share one operator bot.
Apply the same logic to other chat and paste-site webhooks that stealers use, such as Discord webhooks, since the control is identical.

Vetted sources

Use SigmaHQ DNS and network rules for Telegram API access from uncommon processes, Elastic and Splunk ESCU analytics for exfiltration over web services, and Telegram’s Bot API documentation for URL structure. Baseline sanctioned bots and approved Telegram use before enabling blocking.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Process-Aware DNS and Network Hunting

Egress Policy

Build Detections That Fire

Infostealer Detection

Detection Hub

Stealer C2 Exfiltration Detection

Discord Token Theft Detection