Detectionmediumtest

Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Tue Jun 05Updated Sun Oct 09c64c5175-5189-431b-a55e-6d9882158251network

Log Source

dns

Categorydns← raw: dns

Detection Logic

detection:
    selection:
        query: 'api.telegram.org'   # Telegram Bot API Request https://core.telegram.org/bots/faq
    condition: selection

False Positives

Legitimate use of Telegram bots in the company

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

c64c5175-5189-431b-a55e-6d9882158251

Status

test

Level

medium

Type

Detection

Created

Tue Jun 05

Modified

Sun Oct 09

Author

Path

rules/network/dns/net_dns_susp_telegram_api.yml

Raw Tags

attack.command-and-controlattack.t1102.002