Detectionmediumtest

Telegram API Access

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Tue Jun 05Updated Thu May 18b494b165-6634-483d-8c47-2026a6c52372web
Log Source
Proxy Log
CategoryProxy Log← raw: proxy
Detection Logic
Detection Logic2 selectors
detection:
    selection:
        cs-host: 'api.telegram.org' # Often used by Bots
    filter:
        c-useragent|contains:
            # Used https://core.telegram.org/bots/samples for this list
            - 'Telegram'
            - 'Bot'
    condition: selection and not filter
False Positives

Legitimate use of Telegram bots in the company

Rule Metadata
Rule ID
b494b165-6634-483d-8c47-2026a6c52372
Status
test
Level
medium
Type
Detection
Created
Tue Jun 05
Modified
Thu May 18
Path
rules/web/proxy_generic/proxy_telegram_api.yml
Raw Tags
attack.defense-evasionattack.command-and-controlattack.t1071.001attack.t1102.002
View on GitHub