Non-Browser Process Beacons to Vidar Dead-Drop Resolver (Telegram/Steam)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•2

Detects network connections to known Telegram or Steam community profile pages used by the Vidar information stealer as dead-drop resolvers to retrieve secondary C2 infrastructure. The rule specifically filters for non-browser processes to reduce noise from legitimate user traffic.