Detection Engineering Brief - Wednesday, August 19, 2026

Detection Engineering Summary

This brief produced 3 detection candidates.

0 production candidates, 3 hunting-only, 0 require environment mapping, and 0 rejected.

3 detections include KQL. 3 include ATT&CK mappings. 3 include triage guidance.

Search metadata extracted for this run includes: Windows, macOS, Telegram, MacSync Stealer, T1587, T1071, T1071.001.

No explicit IOCs were preserved for this run.

Deployment blockers or scheduling gates were identified for: Telegram API Exfiltration Combined with Persistence Creation; Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths; MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes.

Detection candidates were derived from recent cybersecurity reporting, operational threat research, RSS intelligence feeds, and related detection engineering sources.

Detection 1: Telegram API Exfiltration Combined with Persistence Creation

Detection Opportunity

Outbound connections to Telegram API for data exfiltration combined with creation of scheduled tasks or registry run keys for persistence, as observed in the Operation ASTERIX crypto fraud pipeline.

Intelligence Context

• Rapid7: Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline — https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
  • Context: Recovered artifacts from Operation ASTERIX included Telegram exfiltration code alongside persistence mechanisms such as scheduled tasks and registry run keys, indicating a coordinated fraud toolchain designed to maintain access and exfiltrate victim data via Telegram’s API.

Search Metadata

• CVEs: Not specified
• Threat actors: Not specified
• ATT&CK tags: T1587
• Products: Not specified
• Platforms: Windows, macOS
• Malware: Not specified
• Tools: Not specified
• Search tags: Windows, macOS, Telegram, T1587

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: high
• MITRE ATT&CK: resource development: T1587 Develop Capabilities (low)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.

Required telemetry:

• DeviceNetworkEvents, DeviceRegistryEvents

KQL

let lookback = 24h;
let correlationWindowMinutes = 60;
let knownTelegramClients = dynamic(["Telegram.exe", "Telegram"]);
let telegramConnections = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemoteUrl has "api.telegram.org"
| where RemotePort == 443
| where not(InitiatingProcessFileName has_any (knownTelegramClients))
| project
    DeviceName,
    DeviceId,
    TelegramTime = Timestamp,
    ExfilProcess = InitiatingProcessFileName,
    ExfilCommandLine = InitiatingProcessCommandLine,
    RemoteUrl;
let persistenceEvents = DeviceRegistryEvents
| where Timestamp > ago(lookback)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has_any (
    "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
    "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce"
  )
| project
    DeviceName,
    DeviceId,
    PersistTime = Timestamp,
    PersistProcess = InitiatingProcessFileName,
    PersistCommandLine = InitiatingProcessCommandLine,
    RegistryKey,
    RegistryValueName,
    RegistryValueData;
telegramConnections
| join kind=inner persistenceEvents on DeviceId
| extend TimeDeltaMinutes = abs(datetime_diff('minute', TelegramTime, PersistTime))
| where TimeDeltaMinutes <= correlationWindowMinutes
| project
    DeviceName,
    DeviceId,
    TelegramTime,
    ExfilProcess,
    ExfilCommandLine,
    RemoteUrl,
    PersistTime,
    PersistProcess,
    PersistCommandLine,
    RegistryKey,
    RegistryValueName,
    RegistryValueData,
    TimeDeltaMinutes
| order by TelegramTime desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• Software installers that bundle Telegram-based notification functionality and also write run keys during installation.
• IT automation tools that use Telegram bots for alerting and also configure startup entries on managed endpoints.
• Legitimate Telegram desktop client updates that write run keys during the same session as API connectivity.

Tuning notes:

• Reduce correlationWindowMinutes to 15 if the environment shows that legitimate installers write run keys within 60 minutes of any Telegram API call.
• Expand the knownTelegramClients exclusion list if additional Telegram client binary names are observed in the environment.
• Add InitiatingProcessSHA256 to the projection once a baseline of known-good hashes is established to enable hash-based triage.

Risks / caveats:

• RemoteUrl population in DeviceNetworkEvents depends on DNS-layer or HTTP inspection telemetry being enabled; environments without full URL inspection may only see RemoteIP, causing the api.telegram.org filter to return no results.
• DeviceRegistryEvents ActionType values RegistryValueSet and RegistryKeyCreated require MDE sensor version supporting registry event collection; older sensor versions may not populate these events.
• Scheduled task persistence (schtasks.exe activity) is not covered by this query; a supplementary DeviceProcessEvents query targeting schtasks.exe with /create arguments should be run in parallel.
• The 60-minute correlation window is heuristic; environments with long-running software installers may need this reduced to 15-30 minutes to limit coincidental matches.

Triage Runbook

First 15 minutes:

• Confirm the affected device, user, and exact timestamps for both the Telegram connection and registry change; verify they occurred within the correlation window.
• Inspect the initiating process command line for scripting, encoded commands, archive extraction, or downloader behavior rather than interactive Telegram usage.
• Check whether the process is Telegram.exe or another known Telegram client; if it is not, treat the activity as suspicious and continue investigation.
• Review the registry value data written to Run/RunOnce to identify the payload path, script, or binary that will execute at logon.
• Look for concurrent signs of credential theft, browser data access, archive creation, or additional outbound connections from the same host.

Evidence to collect:

• DeviceNetworkEvents for the Telegram connection, including RemoteUrl, RemotePort, initiating process name, and command line.
• DeviceRegistryEvents for the Run/RunOnce write, including RegistryKey, RegistryValueName, RegistryValueData, and initiating process details.
• DeviceProcessEvents around the same time to identify the parent process, child processes, and any schtasks.exe activity not covered by the alert.
• DeviceFileEvents for recently created or dropped executables, scripts, archives, or wallet-related files on the host.
• User context: logged-on user, recent downloads, and whether Telegram is installed and actively used on the endpoint.

Pivot points:

• DeviceProcessEvents to pivot on the initiating process and search for schtasks.exe, powershell.exe, wscript.exe, mshta.exe, python.exe, or archive tools.
• DeviceFileEvents to find files created by the same process or user around the alert time, especially in Temp, Downloads, or AppData.
• DeviceNetworkEvents to enumerate other outbound destinations from the same process or host, especially additional API endpoints or cloud storage.
• DeviceRegistryEvents to review all Run/RunOnce modifications by the same device and user in the last 24 hours.
• DeviceInfo and DeviceLogonEvents to confirm device ownership, user session timing, and whether the host is a managed endpoint.

Benign explanations:

• A legitimate Telegram desktop client or updater may connect to api.telegram.org and write startup entries during installation or update.
• An IT automation or notification tool may use Telegram bots for alerts and also create persistence for a managed agent.
• A software installer may temporarily write Run/RunOnce keys while staging an application that uses Telegram for messaging or support.

Escalation criteria:

• The initiating process is not Telegram.exe and the command line shows scripting, encoded content, or a downloader/extractor.
• The registry value points to a suspicious script, temp path, user profile path, or unsigned binary that will execute at logon.
• There are additional indicators of compromise such as browser credential access, archive staging, or multiple suspicious outbound connections.
• The host is a high-value system, privileged user workstation, or contains sensitive financial or customer data.

Containment actions:

• If malicious behavior is confirmed or strongly suspected, isolate the device from the network in Defender XDR.
• Terminate the suspicious process and remove the malicious Run/RunOnce entry after preserving evidence.
• Reset credentials for the affected user if there are signs of credential theft or session abuse.
• Block any identified malicious domains, URLs, or hashes if they are discovered during triage.

Closure criteria:

• The Telegram activity is attributable to a known-good Telegram client, updater, or approved automation tool.
• The registry change is explained by a legitimate installer or managed software deployment and no other suspicious behavior is present.
• No additional suspicious processes, files, or outbound connections are found on the host after review.
• Document the benign rationale, add approved process or path exceptions if appropriate, and close the alert.

Detection 2: Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths

Detection Opportunity

Creation of application files with wallet-related naming conventions in non-standard directories, consistent with the packaging of fake cryptocurrency wallet applications observed in Operation ASTERIX.

Intelligence Context

• Rapid7: Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline — https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing
  • Context: Recovered artifacts from Operation ASTERIX included fake wallet applications prepared for distribution. These were packaged by the threat actors as part of the fraud pipeline to deceive victims into installing credential-harvesting software disguised as legitimate cryptocurrency wallets.

Search Metadata

• CVEs: Not specified
• Threat actors: Not specified
• ATT&CK tags: T1587
• Products: Not specified
• Platforms: Windows, macOS
• Malware: Not specified
• Tools: Not specified
• Search tags: Windows, macOS, Telegram, T1587

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: medium
• MITRE ATT&CK: resource development: T1587 Develop Capabilities (low)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.
• Defender for Endpoint file-event coverage must be confirmed on the target host population.

Required telemetry:

• DeviceFileEvents

KQL

let lookback = 7d;
let walletTerms = dynamic(["wallet", "metamask", "ledger", "trezor", "exodus", "coinbase", "trustwallet", "phantom"]);
let suspiciousPaths = dynamic([
    "\\AppData\\Temp",
    "\\AppData\\Local\\Temp",
    "\\Users\\Public",
    "\\Downloads",
    "/tmp/",
    "/var/tmp/",
    "/Users/Shared/"
]);
let packagingProcesses = dynamic([
    "python.exe", "python3", "python",
    "node.exe", "node",
    "powershell.exe", "pwsh.exe",
    "bash", "sh", "zsh",
    "zip", "7z.exe", "7z", "tar",
    "WinRAR.exe"
]);
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType == "FileCreated"
| where tolower(FileName) has_any (walletTerms)
| where FileName endswith_cs ".exe"
    or FileName endswith_cs ".dmg"
    or FileName endswith_cs ".pkg"
    or FileName endswith_cs ".app"
    or FileName endswith_cs ".zip"
    or FileName endswith_cs ".msi"
    or FileName endswith_cs ".sh"
| where FolderPath has_any (suspiciousPaths)
| where InitiatingProcessFileName has_any (packagingProcesses)
| project
    Timestamp,
    DeviceName,
    DeviceId,
    FileName,
    FolderPath,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessAccountName,
    SHA256
| order by Timestamp desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• Legitimate cryptocurrency wallet software downloaded by users to their Downloads folder and extracted by archiving tools.
• Developer environments where wallet-related open-source projects are built using Python or Node.js in AppData or temp directories.
• IT packaging pipelines that repackage legitimate wallet software for enterprise deployment using scripting tools.

Tuning notes:

• Run over a 30-day baseline to identify recurring legitimate matches and build a SHA256 or FolderPath exclusion list before scheduling.
• Expand walletTerms with additional brand names or threat-actor-specific strings if subsequent reporting discloses specific fake wallet application names used in Operation ASTERIX.
• Restrict packagingProcesses to scripting interpreters only (python, node, powershell, bash) if archiving tools generate excessive volume from legitimate software builds.

Risks / caveats:

• DeviceFileEvents does not expose a code-signing or certificate validity field; the detection description references unsigned applications but this attribute cannot be evaluated within this table alone.
• DeviceFileEvents SHA256 field may be empty for files created by certain system processes or when the file is written in segments; null SHA256 values reduce triage fidelity.
• The original query referenced DeviceProcessEvents in required_tables but the improved query does not join to it because ProcessCommandLine is already available via InitiatingProcessCommandLine in DeviceFileEvents; no schema gap introduced.
• No confirmed file hashes or wallet application names from Operation ASTERIX reporting are available to anchor results; all matches are heuristic and require analyst review.

Triage Runbook

First 15 minutes:

• Confirm the file name, folder path, and creation time; verify whether the location is a user-writable or temporary directory.
• Inspect the initiating process name and command line to determine whether the file was created by an installer, archive tool, or scripting interpreter.
• Review the SHA256 if present and check whether the file is already known-good in your environment or associated with approved software.
• Determine whether the file is an executable or package format and whether the user intentionally downloaded or built wallet-related software.
• Check for nearby file creations, archive extraction, or additional wallet-themed files from the same process or account.

Evidence to collect:

• DeviceFileEvents for the created file and any related files in the same directory or by the same process.
• InitiatingProcessCommandLine and account context to identify whether the action came from a script, build tool, or user-driven install.
• SHA256 and file metadata for reputation checks and internal allowlist comparison.
• DeviceProcessEvents to identify the parent process, child processes, and any subsequent execution of the created file.
• DeviceNetworkEvents to see whether the creating process or file immediately contacted download, update, or exfiltration endpoints.

Pivot points:

• DeviceFileEvents to find other wallet-related file creations by the same user or process in the last 7 days.
• DeviceProcessEvents to pivot on the initiating process and look for python, node, powershell, bash, zip, 7z, tar, or installer activity.
• DeviceNetworkEvents to identify whether the same host or process downloaded the bundle from a suspicious source.
• DeviceInfo to confirm whether the endpoint is Windows or macOS and whether the path is consistent with that platform.
• DeviceRegistryEvents on Windows to see whether the same process also created Run/RunOnce persistence.

Benign explanations:

• A user may have downloaded legitimate cryptocurrency wallet software into Downloads or Temp before moving or extracting it.
• A developer may be building or packaging an open-source wallet project in a non-standard directory.
• An IT packaging workflow may repackage legitimate wallet software for deployment using scripting or archiving tools.

Escalation criteria:

• The file is unsigned or has a suspicious hash and was created by a script, downloader, or archive tool in a temp or user profile path.
• The file name mimics a known wallet brand but the source, publisher, or path is inconsistent with approved software distribution.
• The file is later executed, persists, or is accompanied by credential theft, browser access, or suspicious network activity.
• Multiple wallet-themed files or related artifacts appear on the same host or across multiple hosts.

Containment actions:

• If the file is confirmed malicious or is being executed, isolate the host and prevent further user interaction with the artifact.
• Quarantine or remove the file after preserving a copy for analysis if your process allows it.
• Block the SHA256 or parent process if a malicious package or downloader is identified.
• Reset affected user credentials if the bundle appears to be part of a credential-harvesting campaign.

Closure criteria:

• The file is a known-good wallet application, approved package, or expected developer artifact and the path is explained.
• The initiating process and command line match a legitimate installer, build pipeline, or user-approved extraction workflow.
• No execution, persistence, or suspicious network activity is associated with the file.
• Document the benign source and add the hash, path, or process to an allowlist if appropriate.

Detection 3: MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes

Detection Opportunity

macOS processes making repeated outbound connections to newly registered or short-lived domains with consistent URI patterns, consistent with MacSync Stealer’s domain rotation behavior while maintaining stable exfiltration tradecraft.

Intelligence Context

• Microsoft Security Blog: Hunting MacSync Stealer infrastructure through behavioral pivots — https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
  • Context: Microsoft’s analysis of MacSync Stealer found that it rapidly rotates domains to evade detection while keeping its behavioral patterns consistent. Infrastructure hunting using durable behavioral pivots uncovered 30+ related domains, indicating that process-to-domain relationship patterns are more reliable detection anchors than specific IOCs.

Search Metadata

• CVEs: Not specified
• Threat actors: Not specified
• ATT&CK tags: T1071, T1071.001
• Products: Not specified
• Platforms: macOS
• Malware: MacSync Stealer
• Tools: Not specified
• Search tags: macOS, MacSync Stealer, T1071, T1071.001

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: high
• MITRE ATT&CK: command and control: T1071 Application Layer Protocol/ T1071.001 Web Protocols (medium)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.

Required telemetry:

• DeviceNetworkEvents, DeviceInfo

KQL

let lookback = 24h;
let distinctDomainThreshold = 5;
let maxUniquePathSegments = 3;
let knownBrowsers = dynamic(["Safari", "firefox", "Google Chrome", "Chromium", "opera", "brave", "msedge"]);
let knownUpdaters = dynamic(["softwareupdated", "nsurlsessiond", "com.apple.MobileAsset"]);
let macOSDevices = DeviceInfo
| where Timestamp > ago(lookback)
| where OSPlatform == "macOS"
| summarize arg_max(Timestamp, *) by DeviceId
| project DeviceId, DeviceName;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteUrl)
| where not(InitiatingProcessFileName has_any (knownBrowsers))
| where not(InitiatingProcessFileName has_any (knownUpdaters))
| join kind=inner macOSDevices on DeviceId
| extend UriPath = tostring(parse_url(RemoteUrl)["Path"])
| summarize
    DistinctDomains = dcount(RemoteUrl),
    DistinctIPs = dcount(RemoteIP),
    UriPaths = make_set(UriPath, 20),
    SampleUrls = make_set(RemoteUrl, 5),
    SampleIPs = make_set(RemoteIP, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    InitiatingProcessCommandLine = take_any(InitiatingProcessCommandLine),
    InitiatingProcessAccountName = take_any(InitiatingProcessAccountName)
    by DeviceName, DeviceId, InitiatingProcessFileName
| where DistinctDomains >= distinctDomainThreshold
| extend NonEmptyPaths = array_length(UriPaths) - array_length(set_intersect(UriPaths, dynamic(["", "/"])))
| extend UniquePathSegments = iff(NonEmptyPaths < 0, 0, NonEmptyPaths)
| where UniquePathSegments <= maxUniquePathSegments
| project
    DeviceName,
    DeviceId,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessAccountName,
    DistinctDomains,
    DistinctIPs,
    UniquePathSegments,
    UriPaths,
    SampleUrls,
    SampleIPs,
    FirstSeen,
    LastSeen
| order by DistinctDomains desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• macOS applications that use multiple CDN endpoints with consistent API path structures, such as telemetry or analytics SDKs.
• Software update frameworks that poll multiple mirrors using a consistent URI format.
• Development tools or package managers that contact multiple registry or repository endpoints with similar path structures.

Tuning notes:

• Confirm DeviceInfo.OSPlatform values for macOS endpoints in the environment before running; adjust the filter value if the platform reports as ‘Mac’ or another variant.
• Increase distinctDomainThreshold above 5 if legitimate macOS applications in the environment contact many CDN endpoints from a single process during normal operation.
• Tighten maxUniquePathSegments to 1 or 2 if baseline analysis shows that legitimate multi-domain processes use more varied URI structures than the malware.
• Extend the lookback window to 48h or 72h if the threat actor’s domain rotation cadence is slower than daily.

Risks / caveats:

• RemoteUrl population in DeviceNetworkEvents requires HTTP/HTTPS inspection telemetry; environments without full URL inspection will have empty or null RemoteUrl values, causing the URI path extraction and domain counting logic to produce no meaningful results.
• DeviceInfo.OSPlatform field value for macOS endpoints must be confirmed as ‘macOS’ in the target environment; alternative values such as ‘Mac’ or ‘Darwin’ would cause the OS filter to exclude all macOS devices.
• The OSPlatform value ‘macOS’ used in the DeviceInfo filter must be confirmed against the actual values populated in the target environment; if the value differs, the macOS scope filter will silently exclude all intended devices.
• The DistinctDomains threshold of 5 and UniquePathSegments threshold of 3 are heuristic approximations derived from the source reporting description and have not been validated against a production baseline; both may require adjustment after baselining.

Triage Runbook

First 15 minutes:

• Identify the initiating process, its full command line, and the user account on the macOS endpoint.
• Review the set of contacted domains and paths to see whether the process is repeatedly calling many short-lived domains with a small number of consistent URI patterns.
• Check whether the process is a browser, system updater, or known application that legitimately uses multiple CDN or API endpoints.
• Confirm whether the host is a macOS device and whether the activity is occurring outside normal update or browser traffic windows.
• Look for concurrent signs of credential theft, browser data access, archive staging, or unusual child processes from the same parent.

Evidence to collect:

• DeviceNetworkEvents showing RemoteUrl, RemoteIP, RemotePort, timestamps, and the initiating process details.
• DeviceInfo records to confirm OSPlatform, device identity, and whether the host is managed.
• DeviceProcessEvents for the initiating process and any child processes, especially archive tools, shell scripts, or credential access utilities.
• DeviceFileEvents for recent downloads, temporary files, or browser data access on the same host.
• User and session context to determine whether the activity aligns with a known application update, browser session, or user-initiated workflow.

Pivot points:

• DeviceNetworkEvents to enumerate all domains, IPs, and URI paths contacted by the same process over 24-72 hours.
• DeviceProcessEvents to pivot on the process name and command line and identify launch agents, shell scripts, or suspicious parent processes.
• DeviceFileEvents to search for recently created or accessed browser databases, archives, or staging directories.
• DeviceInfo to validate macOS scope and identify other endpoints running the same process or command line.
• DeviceLogonEvents or equivalent identity telemetry to correlate the activity with user logon sessions and remote access.

Benign explanations:

• A legitimate macOS application may use multiple CDN endpoints with consistent API paths for telemetry, updates, or content delivery.
• Software update frameworks may contact several mirrors or service endpoints using similar URI structures.
• Development tools, package managers, or sync clients may generate repeated web requests to multiple domains from one process.

Escalation criteria:

• The process is not a browser, updater, or approved application and the domain-rotation pattern persists across multiple destinations.
• The command line or parent process indicates scripting, launch agent abuse, or execution from a user-writable location.
• There are signs of credential theft, browser data access, or additional suspicious processes on the same host.
• The same behavior appears on multiple macOS endpoints or is associated with a privileged user account.

Containment actions:

• If malicious behavior is confirmed or strongly suspected, isolate the macOS host from the network.
• Terminate the suspicious process and disable any related LaunchAgent or LaunchDaemon persistence discovered during triage.
• Reset affected user credentials and revoke active sessions if browser or token theft is suspected.
• Block identified malicious domains or IPs if they are confirmed to be part of the campaign.

Closure criteria:

• The process is identified as a known-good browser, updater, sync client, or approved enterprise application.
• The domain and URI pattern are consistent with legitimate service behavior and no other suspicious artifacts are present.
• No evidence of credential theft, persistence, or malicious child processes is found on the host.
• Document the benign application behavior and tune the detection if the pattern is recurring and approved.

Recommended Next Actions

Pre-Deployment Checklist by Dependency Type

Schema / correlation keys:

• Telegram API Exfiltration Combined with Persistence Creation: Do not schedule yet; validate as an analyst-led hunt first.
• Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths: Do not schedule yet; validate as an analyst-led hunt first.
• MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes: Do not schedule yet; validate as an analyst-led hunt first.

Other deployment dependency:

• Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths: Defender for Endpoint file-event coverage must be confirmed on the target host population.

Shared-table notes:

• DeviceNetworkEvents: shared by Telegram API Exfiltration Combined with Persistence Creation; MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes

Sequenced Deployment Plan

1. Keep hunting-only detections in analyst-led mode until their promotion criteria are met: Telegram API Exfiltration Combined with Persistence Creation; Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths; MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes.

Hunting Agenda and Promotion Criteria

• Telegram API Exfiltration Combined with Persistence Creation: Do not schedule yet; validate as an analyst-led hunt first.; baseline expected benign activity and define an alert-volume threshold.
• Unsigned Wallet-Named Application Bundle Created Outside Standard Install Paths: Do not schedule yet; validate as an analyst-led hunt first.; baseline expected benign activity and define an alert-volume threshold; prove correlation keys join correctly on real tenant telemetry.
• MacSync Stealer Behavioral Pattern: Repeated Outbound Connections to Short-Lived Domains from macOS Processes: Do not schedule yet; validate as an analyst-led hunt first.; baseline expected benign activity and define an alert-volume threshold.

Unique Blind Spot Callout

No unique blind spot was isolated beyond the detection-specific gates above.

Generated by DevSecOpsDadAttack threat intelligence and detection engineering. Validate detections before deployment.