- Create your bot with botfather
- Make you bot an admin of your channel
Go to Telegram web and open a channel, get the ID from -[channel id] from hash in the path
https://web.telegram.org/k/#-9999999999999
| title: Suspicious msdt.exe execution - Office Exploit | |
| id: 97a80ed7-1f3f-4d05-9ef4-65760e634f6b | |
| status: experimental | |
| description: This rule will monitor suspicious arguments passed to the msdt.exe process. These arguments are an indicator of recent Office/Msdt exploitation. | |
| references: | |
| - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e | |
| - https://twitter.com/MalwareJake/status/1531019243411623939 | |
| author: 'Matthew Brennan' | |
| tags: | |
| - attack.execution |
| // Mac OS Big Sur 11.2.3: | |
| http://swcdn.apple.com/content/downloads/12/32/071-14766-A_Q2H6ELXGVG/zx8saim8tei7fezrmvu4vuab80m0e8a5ll/InstallAssistant.pkg | |
| // Mac OS Catalina 10.15: | |
| https://itunes.apple.com/us/app/macos-catalina/id1466841314?ls=1&mt=12 | |
| // Mac OS Mojave 10.14: | |
| https://itunes.apple.com/us/app/macos-mojave/id1398502828?ls=1&mt=12 | |
| // Mac OS High Sierra 10.13: |