macOS.Gaslight Backdoor Command Dispatch via Telegram C2 (shell/upload/persist)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•5•0•4

Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).