Infostealer Telegram Bot API Exfiltration from node.exe or chost.exe with Credential File Access
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
YARA-L
