{"id":"c3dbbc9f-ef1d-470a-a90a-d343448d5875","title":"Suspicious Non-Browser Network Communication With Telegram API","description":"Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-19","modified":"","tags":["attack.command-and-control","attack.exfiltration","attack.t1102","attack.t1567","attack.t1105"],"technique_ids":["T1102","T1105","T1567"],"logsource":{"product":"windows","category":"network_connection"},"falsepositives":["Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS  etc."],"references":["https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf"],"source_path":"rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml","source_sha256":"47e200ea1b237d18fd6e115a418857dfe8c8f085a8560b06c208957781f031ce","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Non-Browser Network Communication With Telegram API\nid: c3dbbc9f-ef1d-470a-a90a-d343448d5875\nstatus: test\ndescription: Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2\nreferences:\n    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-19\ntags:\n    - attack.command-and-control\n    - attack.exfiltration\n    - attack.t1102\n    - attack.t1567\n    - attack.t1105\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        DestinationHostname|contains: 'api.telegram.org'\n    # Other browsers or apps known to use telegram should be added\n    # TODO: Add full paths for default install locations\n    filter_main_brave:\n        Image|endswith: '\\brave.exe'\n    filter_main_chrome:\n        Image:\n            - 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'\n            - 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'\n    filter_main_firefox:\n        Image:\n            - 'C:\\Program Files\\Mozilla Firefox\\firefox.exe'\n            - 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'\n    filter_main_ie:\n        Image:\n            - 'C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe'\n            - 'C:\\Program Files\\Internet Explorer\\iexplore.exe'\n    filter_main_maxthon:\n        Image|endswith: '\\maxthon.exe'\n    filter_main_edge_1:\n        - Image|startswith: 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\'\n        - Image|endswith: '\\WindowsApps\\MicrosoftEdge.exe'\n        - Image:\n              - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'\n              - 'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe'\n    filter_main_edge_2:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n    filter_main_opera:\n        Image|endswith: '\\opera.exe'\n    filter_main_safari:\n        Image|endswith: '\\safari.exe'\n    filter_main_seamonkey:\n        Image|endswith: '\\seamonkey.exe'\n    filter_main_vivaldi:\n        Image|endswith: '\\vivaldi.exe'\n    filter_main_whale:\n        Image|endswith: '\\whale.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS  etc.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1567","id":"T1567","name":"Exfiltration Over Web Service","page":"techniques/enterprise/T1567/"}],"data_path":"data/detection-rules/c3dbbc9f-ef1d-470a-a90a-d343448d5875.json","kind":"sigma"}