Telegram API Access

Title: Telegram API Access
Status: test
Description:Detects suspicious requests to Telegram API without the usual Telegram User-Agent
References:
  -https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  -https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  -https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
Author: Florian Roth (Nextron Systems)
Date: 2018-06-05
modified:2023-05-18
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'
• -'attack.t1102.002'

Logsource:

• category: proxy

Detection:
  selection:
    cs-host: 'api.telegram.org'
  filter:
    c-useragent|contains:
      -'Telegram'
      -'Bot'

  condition:selection and not filter
Falsepositives:
  -Legitimate use of Telegram bots in the company
Level: medium