Title:
Suspicious Non-Browser Network Communication With Telegram API
Status:
test
Description:Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
References:
-https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-19
modified:None
Tags:
- -'attack.command-and-control'
- -'attack.exfiltration'
- -'attack.t1102'
- -'attack.t1567'
- -'attack.t1105'
Logsource:
- product: windows
- category: network_connection
Detection:
selection:
DestinationHostname|contains:
'api.telegram.org'
filter_main_brave:
Image|endswith:
'\brave.exe'
filter_main_chrome:
Image:
-'C:\Program Files\Google\Chrome\Application\chrome.exe'
-'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
filter_main_firefox:
Image:
-'C:\Program Files\Mozilla Firefox\firefox.exe'
-'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
filter_main_ie:
Image:
-'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
-'C:\Program Files\Internet Explorer\iexplore.exe'
filter_main_maxthon:
Image|endswith:
'\maxthon.exe'
filter_main_edge_1:
Image|startswith:
'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'
Image|endswith:
'\WindowsApps\MicrosoftEdge.exe'
- Image:
- 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
- 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
filter_main_edge_2:
Image|startswith:
-'C:\Program Files (x86)\Microsoft\EdgeCore\'
-'C:\Program Files\Microsoft\EdgeCore\'
Image|endswith:
-'\msedge.exe'
-'\msedgewebview2.exe'
filter_main_opera:
Image|endswith:
'\opera.exe'
filter_main_safari:
Image|endswith:
'\safari.exe'
filter_main_seamonkey:
Image|endswith:
'\seamonkey.exe'
filter_main_vivaldi:
Image|endswith:
'\vivaldi.exe'
filter_main_whale:
Image|endswith:
'\whale.exe'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS etc.
Level:
medium
