DNS queries to api.telegram.org from Telegram Bot API clients

title: DNS queries to api.telegram.org from Telegram Bot API clients
id: beda47ed-367e-414b-82de-7c7a5878aea7
status: test
description: This rule identifies DNS lookups for api.telegram.org, which is the endpoint used by Telegram bots to reach the Telegram Bot API. Attackers commonly leverage bot APIs for command-and-control because they blend into normal internet traffic and can be reused by automated malware. The detection relies on DNS query telemetry that includes the queried domain name.
references:
  - https://core.telegram.org/bots/faq
  - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_susp_telegram_api.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-05
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1102.002
logsource:
  category: dns
detection:
  selection:
    query: api.telegram.org
  condition: selection
falsepositives:
  - Legitimate use of Telegram bots in the company
level: medium
license: DRL-1.1
related:
  - id: c64c5175-5189-431b-a55e-6d9882158251
    type: derived