ThreatFox: TelegramGrabber IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of TelegramGrabber indicators to exfiltrate sensitive data via the Telegram messaging platform. A SOC team should proactively search for these specific IOCs in Azure Sentinel to identify early-stage compromise and prevent potential data leakage before it escalates into a broader incident.

IOC Summary

Malware Family: TelegramGrabber Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TelegramGrabber
let malicious_domains = dynamic(["workvmailbox-central.berrygleam.org", "serwis-o2.netlify.app", "tankstars-mod.systemtutos.com", "fexdeliverypro.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TelegramGrabber

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: TelegramGrabber IOCs detection rule in an enterprise environment:

• Legitimate Scenario: Endpoint Security Agent Updates

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently download definition updates, threat intelligence feeds, or configuration scripts from cloud repositories. These downloads may originate from IP addresses or domains that overlap with the TelegramGrabber IOCs, especially if the vendor utilizes shared CDN infrastructure or specific telemetry endpoints.
  • Suggested Filter: Create an exclusion rule based on the Process Name and Parent Process. Exclude alerts where the process name matches falcon.sys, s1agent.exe, or MsMpEng.exe (Microsoft Defender) and the parent process is the respective security service manager.

• Legitimate Scenario: Scheduled Data Backup Jobs via Cloud Storage

  • Context: Automated backup solutions such as Veeam, Rubrik, or Commvault often utilize cloud storage gateways to transfer data snapshots. If these tools are configured to use specific external APIs for metadata synchronization, they may generate network traffic matching the TelegramGrabber IOCs (e.g., specific user-agent strings or destination ports) during their nightly maintenance windows.
  • Suggested Filter: Implement a time-based exclusion combined with a Process Path filter. Exclude alerts occurring between 01:00 and 05:00 local time where the process path contains \Program Files\Veeam\ or \Rubrik\Agent\, provided the destination port is not part of the specific TelegramGrabber payload range (e.g., exclude if traffic is on standard HTTPS ports 443 unless the IOC specifically targets non-standard ports).

• **Legitimate