Telegram Session Authorization From New Device Preceding GhostCall Propagation
Detects a Telegram account session being authorized from a new device/IP, which BlueNoroff has been observed abusing as the precursor step in the GhostCall self-propagation pipeline: operators reuse stolen/hijacked Telegram session cookies from a new device or IP, then use the hijacked session to send fake meeting invites to trusted contacts, enabling cyclical propagation to subsequent victims. This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
Sigma
