rule Telerik_Cve_2019_18935_Telegram_Scanner {
    meta:
        author = "Tia N. List"
        date = "2026-09-28"
        status = "experimental"
        description = "Scanner tooling deployed after CVE-2019-18935 Telerik UI exploitation: a Rust scanner queries exposed WordPress setup pages and exfiltrates results through a hardcoded Telegram bot API token. Derived from case analysis (ASEC, 2026) — NOT validated against a live sample."
        reference = "https://asec.ahnlab.com/en/95561/"
        falsepositives = "Analyst or incident-response tooling that embeds the same strings; the unique Telegram bot token is the high-confidence anchor"
    strings:
        $token = "8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q" ascii
        $tg_api = "api.telegram.org" ascii nocase
        $tg_send = "/sendMessage" ascii
        $telerik = "Telerik.Web.UI.WebResource.axd" ascii nocase
        $wp_probe = "setup-config.php" ascii nocase
    condition:
        $token or (2 of ($tg_api, $tg_send, $telerik, $wp_probe))
}