Windows: Non-Browser Process Connecting to api.telegram.org

title: "Windows: Non-Browser Process Connecting to api.telegram.org"
id: 76c50d5a-6fee-4e4f-9eed-7a41ec624eab
status: test
description: This rule flags network connections from a non-browser process to api.telegram.org by matching the destination hostname. Such traffic can indicate scripted or covert command-and-control activity using Telegram’s API rather than normal browser behavior. It relies on Windows network connection telemetry that includes the destination hostname and the connecting process image path, while excluding common browser executables to reduce false positives.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.command-and-control
  - attack.exfiltration
  - attack.t1102
  - attack.t1567
  - attack.t1105
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationHostname|contains: api.telegram.org
  filter_main_brave:
    Image|endswith: \brave.exe
  filter_main_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_main_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_main_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_main_maxthon:
    Image|endswith: \maxthon.exe
  filter_main_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_main_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_main_opera:
    Image|endswith: \opera.exe
  filter_main_safari:
    Image|endswith: \safari.exe
  filter_main_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_main_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_main_whale:
    Image|endswith: \whale.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS  etc.
level: medium
license: DRL-1.1
related:
  - id: c3dbbc9f-ef1d-470a-a90a-d343448d5875
    type: derived