# Sigma rules for CVE-2026-107181 (Telegram Desktop IPC record injection).
#
# Written against command lines actually observed in the lab, not invented ones.
# The delivery path a browser produces is:
#
#   click tg:// link -> ShellExecute -> HKCU\Software\Classes\tg\shell\open\command
#   -> "Telegram.exe" -- "tg://msg_url?url=x;OPEN:interpret:<path>"
#
# so the whole payload sits in the second process's command line, unescaped,
# before it ever reaches the socket. That is the cleanest place to catch it.
#
# Coverage note: a local attacker who writes to the named pipe directly spawns
# no process at all, so rule 1 cannot see that variant -- rule 2 is what covers
# it. Both are needed.

---
title: Telegram Desktop IPC record injection via tg:// URL
id: 8f3c1b22-0d41-4a6e-9c7a-3e6b1f9a2c01
status: experimental
description: >
  A tg:// URL carrying a raw ';' splits into extra IPC records in Telegram
  Desktop <= 7.2.8. A legitimate tg:// link never contains ';' followed by a
  record keyword, so this is close to zero-false-positive.
references:
  - https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
author: Bahodir Buxorov
date: 2026/10/13
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\Telegram.exe'
    CommandLine|contains: 'tg://'
  injection:
    CommandLine|contains:
      - ';OPEN:'
      - ';CMD:'
      - ';CTRL:'
      - ';XDG_ACTIVATION_TOKEN:'
  condition: selection and injection
falsepositives:
  - None known. ';' is legal in a URL query but no Telegram deep link uses
    these keywords after it.
level: high

---
title: Telegram Desktop interpret scheme reached via IPC injection
id: 8f3c1b22-0d41-4a6e-9c7a-3e6b1f9a2c02
status: experimental
description: >
  The interpret: scheme reads a file named in an instruction file and posts it
  to a channel with no authorization check. Reaching it through an injected
  OPEN: record is arbitrary file exfiltration, so this is the severe case and
  deserves its own rule rather than being folded into the generic one.
author: Bahodir Buxorov
date: 2026/10/13
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\Telegram.exe'
    CommandLine|contains|all:
      - 'tg://'
      - ';OPEN:interpret:'
  condition: selection
falsepositives:
  - "None. interpret: is an internal scheme; it is not reachable from an
    ordinary link, so its presence in a command line is the attack itself."
level: critical

---
title: Non-Telegram process connecting to the Telegram single-instance pipe
id: 8f3c1b22-0d41-4a6e-9c7a-3e6b1f9a2c03
status: experimental
description: >
  Covers the local variant, where the attacker writes records to the pipe
  directly and no second process is created. The pipe name is
  md5(working_dir with '/' separators) plus the fixed application GUID, so the
  hash half varies per installation while the GUID half does not.
author: Bahodir Buxorov
date: 2026/10/13
logsource:
  product: windows
  category: pipe_created
detection:
  pipe:
    EventID: 18   # Pipe Connected
    PipeName|endswith: '-{87A94AB0-E370-4cde-98D3-ACC110C5967D}'
  filter_legit:
    Image|endswith: '\Telegram.exe'
  condition: pipe and not filter_legit
falsepositives:
  - Telegram forks that keep the upstream GUID run under their own image name
    and will need adding to filter_legit.
level: critical

---
title: Telegram Desktop protocol handler hijack
id: 8f3c1b22-0d41-4a6e-9c7a-3e6b1f9a2c04
status: experimental
description: >
  Not the CVE, but the primitive underneath it. The tg:// handler lives under
  HKCU and any user-writable process can repoint it; the lab's portable build
  seized it on first launch without asking. Whoever owns this key owns every
  tg:// click.
author: Bahodir Buxorov
date: 2026/10/13
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: '\Software\Classes\tg\shell\open\command\(Default)'
  condition: selection
falsepositives:
  - A genuine Telegram install or update re-registering itself.
level: medium