Detectionmediumtest
Telegram API Access
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Tue Jun 05Updated Thu May 18b494b165-6634-483d-8c47-2026a6c52372web
Log Source
Proxy Log
CategoryProxy Log← raw: proxy
Detection Logic
Detection Logic2 selectors
detection:
selection:
cs-host: 'api.telegram.org' # Often used by Bots
filter:
c-useragent|contains:
# Used https://core.telegram.org/bots/samples for this list
- 'Telegram'
- 'Bot'
condition: selection and not filterFalse Positives
Legitimate use of Telegram bots in the company
MITRE ATT&CK
Rule Metadata
Rule ID
b494b165-6634-483d-8c47-2026a6c52372
Status
test
Level
medium
Type
Detection
Created
Tue Jun 05
Modified
Thu May 18
Path
rules/web/proxy_generic/proxy_telegram_api.yml
Raw Tags
attack.defense-evasionattack.command-and-controlattack.t1071.001attack.t1102.002