rule Telegram_URL_Encodings {
	meta:
		description = "Detects various encoded forms of Telegram URLs, indicative of potential malicious activity."
		author = "Andy Giron Datadog"
		date = "12/01/23"
	strings:
		$telegram_url = "https://api.telegram.org/" ascii wide
		$string_base64 = "YXBpLnRlbGVncmFtLm9yZwo=" ascii wide
		$string_hex = "6170692E74656C656772616D2E6F72672F" ascii wide
		$reversed_str = "moc.margelet.ipa" ascii wide
	condition:
		1 of them
}