Telegram Bot API Request

Title: Telegram Bot API Request
Status: test
Description:Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
References:
  -https://core.telegram.org/bots/faq
  -https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  -https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  -https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
Author: Florian Roth (Nextron Systems)
Date: 2018-06-05
modified:2022-10-09
Tags:

• -'attack.command-and-control'
• -'attack.t1102.002'

Logsource:

• category: dns

Detection:
  selection:
    query: 'api.telegram.org'
  condition:selection
Falsepositives:
  -Legitimate use of Telegram bots in the company
Level: medium