Detection rules › Sigma
Telegram API Access
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Known false positives
- Legitimate use of Telegram bots in the company
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
title: Telegram API Access
id: b494b165-6634-483d-8c47-2026a6c52372
status: test
description: Detects suspicious requests to Telegram API without the usual Telegram User-Agent
references:
- https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
- https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
- https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
author: Florian Roth (Nextron Systems)
date: 2018-06-05
modified: 2023-05-18
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1102.002
logsource:
category: proxy
detection:
selection:
cs-host: 'api.telegram.org' # Often used by Bots
filter:
c-useragent|contains:
# Used https://core.telegram.org/bots/samples for this list
- 'Telegram'
- 'Bot'
condition: selection and not filter
falsepositives:
- Legitimate use of Telegram bots in the company
level: medium
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
cs-host: 'api.telegram.org'
Stage 2: not filter
filter:
c-useragent|contains:
- 'Telegram'
- 'Bot'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
c-useragent | match | Bot | excludes:c-useragent field:"c-useragent" value:"Bot" |
c-useragent | match | Telegram | excludes:c-useragent field:"c-useragent" value:"Telegram" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-host | eq |
| field:"cs-host" kind:eq value:"api.telegram.org" |