Simple Detection Engineering WorkFlow

The Phishing Attack

1. Eyecatchy Phishing Email

The attack begins with a cleverly designed phishing email. The email’s body is visually appealing, drawing the victim’s attention and prompting them to click on a link. The link claims to lead to a legitimate destination, but instead, it redirects users to a malicious website designed to steal their credentials.

Phishing email content example:

2. Redirection to a Phishing Website

Once the user clicks the link in the email, they are redirected to a phishing page designed to look like a login page for a legitimate service. Here, the attacker prompts the user to enter sensitive information such as their email and password.

Screenshot of phishing page:

3. HTTP GET Request to Telegram API

After the victim enters their credentials, the attacker sends the stolen information to a Telegram bot using the Telegram API. This is done via an HTTP GET request, transferring the victim’s credentials directly to the attacker’s Telegram account.

Example of the HTTP request:

Detection Techniques

Detection Logic 1: SSL Inspection and Proxy Log

To detect the phishing attack, we need to inspect the SSL/TLS traffic and analyze the logs from a web proxy. Key indicators include:

• HTTP GET request sent to the Telegram API (api.telegram.org).
• The URI contains sensitive information such as email and password.

Here is an example of Sigma detection logic that can be applied:

title: Telegram Bot Phishing
id: 63956689-45db-48a7-9820-b632dfb68a53
status: test
description: "Detects phishing using Telegram Bot"
references:

author: "Saw Win Naung"
date: 2024-09-26
modified: 2024-09-26
tags:
  - attack.initial-access
  - attack.T1566.002
logsource:
  category: proxy
detection:
  selection:
    status_code: 200
    host: api.telegram.org
    method: GET
    uri|contains:
      - email
      - password
  condition: selection
falsepositives:
  - Unknown
level: medium

This logic will help security analysts identify suspicious traffic that may indicate a phishing attempt via Telegram.

Detection Logic 2: No SSL Inspection

If SSL inspection is unavailable, you can still detect the attack by monitoring the TLS subject name in network traffic.

• The Zeek network monitor can capture the TLS handshake, and the server name should be flagged if it matches Telegram’s API domain (api.telegram.org).

This method might yield false positives when legitimate users interact with Telegram, so additional context is needed to avoid misidentification.

Suricata Rule for Real-Time Detection

For real-time monitoring, a Suricata rule can be deployed to alert on suspicious activity related to Telegram’s API. The rule will trigger when a TLS certificate associated with api.telegram.org is detected in the network.

alert tls any any -> any any (msg:"Telegram API Certificate Observed"; flow:established,to_client; tls.cert_subject; content:"CN=api.telegram.org"; fast_pattern; nocase; endswith; gid:1; sid:1000000; rev:2;)

This rule will generate an alert when the Telegram API is accessed over a TLS connection, helping security teams investigate further.

Conclusion

Phishing attacks that use platforms like Telegram are becoming more common. By implementing both SSL inspection and Suricata rules, security teams can better detect and mitigate these threats before they result in compromised credentials. By continuously monitoring traffic and updating detection rules, organizations can stay ahead of attackers leveraging unconventional methods for phishing.

Stay safe, stay vigilant.