[rule]
description = """
Identifies an untrusted or unsigned process accessing Telegram data. Adversaries can steal Telegram files that will
allow them access to sensitive data or the ability to login and spy on the user.
"""
id = "2e024f76-8865-4eb2-be11-129bf9f2f1ac"
license = "Elastic License v2"
name = "Telegram Data Accessed by Unsigned or Untrusted Process"
os_list = ["macos"]
version = "1.0.8"
query = '''
file where event.action == "open" and
file.path like~ "/Users/*/Library/Application Support/Telegram Desktop/tdata/*" and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
not process.code_signature.signing_id : ("rg-*", "rg") and
not process.executable like ("/opt/homebrew/*", "/usr/local/Homebrew/*", "/usr/local/Cellar/*")
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.11.1"