Telegram Data Accessed by Unsigned or Untrusted Process

[rule]
description = """
Identifies an untrusted or unsigned process accessing Telegram data. Adversaries can steal Telegram files that will
allow them access to sensitive data or the ability to login and spy on the user.
"""
id = "2e024f76-8865-4eb2-be11-129bf9f2f1ac"
license = "Elastic License v2"
name = "Telegram Data Accessed by Unsigned or Untrusted Process"
os_list = ["macos"]
version = "1.0.8"

query = '''
file where event.action == "open" and 
 file.path like~ "/Users/*/Library/Application Support/Telegram Desktop/tdata/*" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not process.code_signature.signing_id : ("rg-*", "rg") and
 not process.executable like ("/opt/homebrew/*", "/usr/local/Homebrew/*", "/usr/local/Cellar/*")
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"