TOKYOCORE Access to Telegram Desktop Session Data in AppData
Detects unauthorized file access events targeting the Telegram Desktop AppData directory, which is a known technique for exfiltrating messenger session data and credentials. This rule filters for file access actions and is intended to exclude legitimate access by the Telegram application process itself.
Cortex XDR
