Detection of Malicious File Downloads via Telegram

Security teams should monitor for suspicious file downloads initiated by the Telegram desktop application on Windows systems. Adversaries frequently utilize legitimate messaging applications like Telegram as a delivery mechanism for malicious tools, including network scanners, credential stealers, and cryptocurrency miners. This activity is often a precursor to broader compromise, enabling lateral movement and data exfiltration. The threat is identified by monitoring for the creation of files with a Zone.Identifier stream, which signifies that a file has been downloaded from an external source. This detection technique is highly relevant for identifying the initial stage of payload delivery for various malware families, including Phemedrone Stealer, Snake Keylogger, and XMRig miners, across enterprise environments.

Attack Chain

1. The adversary distributes a malicious payload or reconnaissance tool through a Telegram channel or direct message.
2. A compromised or targeted user interacts with the message, triggering a download via the Telegram desktop application.
3. The Telegram process (telegram.exe) writes the downloaded file to the local disk.
4. The Windows OS attaches a Zone.Identifier stream (the 'Mark of the Web') to the newly created file, indicating an origin in the Internet zone.
5. The adversary executes the downloaded file or uses it to perform internal network reconnaissance.
6. The attacker leverages the downloaded tools for lateral movement or further exploitation of the host.
7. The final objective, such as data exfiltration or crypto-jacking, is carried out using the weaponized environment.

Impact

The use of legitimate messaging applications for malware delivery can bypass traditional perimeter-based network security controls. Successful exploitation allows adversaries to establish a foothold, map internal networks, steal sensitive credentials, or deploy resource-intensive payloads like miners. This behavior has been observed in various campaigns, impacting organizations by facilitating unauthorized access and potential data compromise.

Recommendation

Detection engineering teams should implement monitoring for suspicious file creation events associated with the Telegram application.

• Deploy the provided Sigma rule to identify unauthorized file downloads originating from telegram.exe via Sysmon Event ID 15.
• Use the detected events to investigate the origin of the downloaded file and the subsequent behavior of the process that created it.
• Tune the detection logic to account for legitimate usage of the Telegram application in environments where it is an authorized communication tool.