MITRE ATT&CK Technique
T1539
1 query tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Telegram Tdata Session Theft File Access
Theft of Telegram's tdata session directory by an unexpected process. Uses actual DeviceFileEvents ActionTypes (FileCreated/Modified) — `FileRead` doesn't exist.