malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
3rd percentile · 97% of 825 ATT&CK software entries have more detection rules per technique.
6 distinct rules cover the 2 techniques recorded for this malware. 4 Sigma · 2 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Daniel Koifman (KoifSec) | 2025-11-29 | — | 5bac7a56-da88-4c27-922e-c81e113b20cb | ||||
Splunk | The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa | 2025-02-19 | 2026-05-13 | d6b0d627-d0bf-46b1-936f-c48284767d21 | |||
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
th (...) | Hunting | test | network_connection | windows | Sysmon | - | medium | Isaac Dunham | 2024-11-07 | — | 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4 | ||||
Detects suspicious requests to Telegram API without the usual Telegram User-Agent | Generic | test | proxy | - | - | - | medium | Florian Roth (Nextron Systems) | 2018-06-05 | 2023-05-18 | b494b165-6634-483d-8c47-2026a6c52372 | ||||
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind | Generic | test | dns | - | - | - | medium | Florian Roth (Nextron Systems) | 2018-06-05 | 2022-10-09 | c64c5175-5189-431b-a55e-6d9882158251 | ||||
Splunk | The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. (...) | Anomaly | stable | dns | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-08-03 | 2026-07-20 | 86f66f44-94d9-412d-a71d-5d8ed0fef72e |
3rd percentile · 97% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 2 Enterprise techniques.
Technique Campaign use over its cumulative rule count.