SIGNATURE_BASE_MAL_Telnyx_Supplychain_Mar26

rule SIGNATURE_BASE_MAL_Telnyx_Supplychain_Mar26 : FILE
{
	meta:
		description = "Detects malicious indicators used in Telnyx supply chain attack"
		author = "Marius Benthin"
		id = "73d9c3d4-7274-5278-aea3-7e921bf5d0b2"
		date = "2026-03-28"
		modified = "2026-05-15"
		reference = "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_teampcp_mar26.yar#L19-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e"
		logic_hash = "fac4c1a120bd8b046b2cfee677eff47fec6a9347a5a90648b07918337accc9cc"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "bXNidWlsZC5leGU="
		$s2 = "TW96aWxsY"
		$s3 = ".getnframes("
		$s4 = "exec(base64.b64decode("

	condition:
		filesize < 500KB and 3 of them
}