alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible Telegram Proxy Site (getUpdates)"; flow:established,to_server; http.uri; content:"/getUpdates?offset="; fast_pattern; http.host; content:!"api.telegram.org"; reference:url,core.telegram.org/bots/api#senddocument; reference:md5,3402c9373726396598011ef6ec1ea243; classtype:unknown; sid:2044622; rev:1; metadata:created_at 2023_03_14, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_15;)