Suspicious Telegram API Proxy Requests Without Telegram User-Agent

title: Suspicious Telegram API Proxy Requests Without Telegram User-Agent
id: dc46208b-c123-41ce-a0c5-56b6ab150878
status: test
description: This rule flags proxy traffic to api.telegram.org that does not contain the expected Telegram User-Agent substrings (e.g., "Telegram" or "Bot"). Attackers may use Telegram’s API for command-and-control or data exchange while masking as non-Telegram clients. The detection relies on proxy logs capturing the destination host and the client user-agent string.
references:
  - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_telegram_api.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-05
modified: 2023-05-18
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1102.002
logsource:
  category: proxy
detection:
  selection:
    cs-host: api.telegram.org
  filter:
    c-useragent|contains:
      - Telegram
      - Bot
  condition: selection and not filter
falsepositives:
  - Legitimate use of Telegram bots in the company
level: medium
license: DRL-1.1
related:
  - id: b494b165-6634-483d-8c47-2026a6c52372
    type: derived