← Back to SOC feed Coverage →

Detects malicious indicators used in Telnyx supply chain attack

yara CRITICAL signature-base
florian-rothtelnyx_supplychain
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-08-06T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific malicious indicators identified in the Telnyx supply chain compromise to infiltrate Azure Sentinel environments through compromised third-party dependencies. Proactively hunting for these indicators is essential because supply chain attacks often bypass traditional perimeter defenses by exploiting trusted relationships, requiring early detection of subtle anomalies before lateral movement occurs.

YARA Rule

rule MAL_Telnyx_SupplyChain_Mar26 {
   meta:
      description = "Detects malicious indicators used in Telnyx supply chain attack"
      author = "Marius Benthin"
      date = "2026-03-28"
      reference = "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"
      hash = "ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e"
      score = 80
      id = "73d9c3d4-7274-5278-aea3-7e921bf5d0b2"
   strings:
      $s1 = "bXNidWlsZC5leGU="  // msbuild.exe
      $s2 = "TW96aWxsY"  // Mozilla/
      $s3 = ".getnframes("  // number of WAV audio frames
      $s4 = "exec(base64.b64decode("
   condition:
      filesize < 500KB
      and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects malicious indicators used in Telnyx supply chain attack” rule, including suggested filters and exclusions:

Original source: https://github.com/Neo23x0/signature-base/blob/main/yara/mal_teampcp_mar26.yar