[rule]
description = """
Identifies the Osascript process accessing Telegram data. Adversaries can steal Telegram files that will allow them
access to sensitive data or the ability to login and spy on the user.
"""
id = "b11b4670-7368-4269-b199-8c90ed8db511"
license = "Elastic License v2"
name = "Telegram Data Accessed by Osascript"
os_list = ["macos"]
version = "1.0.5"
query = '''
file where event.action == "open" and
file.path like~ "/Users/*/Library/Application Support/Telegram Desktop/tdata/*" and
process.name == "osascript"
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.11.1"