Windows Suspicious Non-Browser Network Traffic to api.telegram.org

title: Windows Suspicious Non-Browser Network Traffic to api.telegram.org
id: 76c50d5a-6fee-4e4f-9eed-7a41ec624eab
status: test
description: This rule flags outbound network connections from processes on Windows whose destination contains api.telegram.org when the initiating process is not one of several known browser and web-view executables. Attackers commonly use messaging APIs like Telegram to blend into normal traffic while acting as command-and-control or for data transfer. It relies on Windows network connection telemetry and process image path information to exclude typical browser activity.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.command-and-control
  - attack.exfiltration
  - attack.t1102
  - attack.t1567
  - attack.t1105
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationHostname|contains: api.telegram.org
  filter_main_brave:
    Image|endswith: \brave.exe
  filter_main_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_main_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_main_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_main_maxthon:
    Image|endswith: \maxthon.exe
  filter_main_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_main_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_main_opera:
    Image|endswith: \opera.exe
  filter_main_safari:
    Image|endswith: \safari.exe
  filter_main_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_main_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_main_whale:
    Image|endswith: \whale.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS  etc.
level: medium
license: DRL-1.1
related:
  - id: c3dbbc9f-ef1d-470a-a90a-d343448d5875
    type: derived