Tchap Account Hijacking: Detection and Containment for Government Messaging Breach

---
title: Tchap Anomalous Geographic Login
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects successful logins to Tchap from two distinct countries within a short time window, indicating possible session hijacking or credential sharing.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.initial_access
  - attack.t1078.004
logsource:
  category: authentication
  product: tchap # Custom logsource for Tchap audit logs
detection:
  selection:
    EventID: 1001 # Hypothetical EventID for Tchap Login Success
    AppName: 'Tchap'
  filter:
    Success: true
  timeframe: 15m
  condition: selection | count(CountryCode) > 1
falsepositives:
  - Users traveling via VPN with unstable exit nodes
  - Mobile roaming across borders
level: high
---
title: Tchap Client Spawning Shell
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects the Tchat desktop client spawning a shell process (cmd.exe, powershell.exe), which may indicate exploitation of the client or a user executing malware delivered via chat.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\Tchap.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate user clicking links in Tchap that open terminals
level: medium

let TchapLogs = Syslog | where Facility == "tchap-security";
let AuthEvents = TchapLogs | where ProcessName contains "auth_success" 
  | project TimeGenerated, SrcIp, User, Country, SessionID, EventType = "Auth";
let DataEvents = TchapLogs | where ProcessName contains "message_read" or ProcessName contains "file_download"
  | project TimeGenerated, SrcIp, User, Country, SessionID, EventType = "Data";
let Combined = AuthEvents | union DataEvents;
Combined
| summarize EventCount = count(), make_list(EventType), make_list(Country) by User, bin(TimeGenerated, 10m)
| where array_length(make_list(Country)) > 1 and array_index_of(make_list(EventType), "Auth") >= 0 and array_index_of(make_list(EventType), "Data") >= 0
| project User, TimeGenerated, Countries = make_list(Country), Events = make_list(EventType)

-- Hunt for Tchap client process anomalies
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'Tchap'

-- Hunt for unusual child processes spawned by Tchap
SELECT Parent.Pid AS ParentPid, Parent.Name AS ParentName, Child.Pid, Child.Name, Child.CommandLine
FROM pslist() AS Parent
JOIN pslist() AS Child ON Parent.Pid = Child.Ppid
WHERE Parent.Name =~ 'Tchap'
  AND Child.Name NOT IN ('conhost.exe', 'Tchap.exe')

# Script to audit Tchap user activity for anomalies
# Requires: Import-Module ActiveDirectory

param(
    [string]$LogPath = "C:\Logs\Tchap\auth_logs.",
    [int]$HoursToScan = 24
)

Write-Host "[*] Initiating Tchap User Audit..." -ForegroundColor Cyan

# Check if log file exists
if (-not (Test-Path $LogPath)) {
    Write-Host "[!] Error: Log file not found at $LogPath" -ForegroundColor Red
    exit
}

# Import logs (Simulated parsing for JSON format)
try {
    $Logs = Get-Content $LogPath | ConvertFrom-Json
}
catch {
    Write-Host "[!] Error parsing log file." -ForegroundColor Red
    exit
}

$CutoffTime = (Get-Date).AddHours(-$HoursToScan)
$RecentLogs = $Logs | Where-Object { [DateTime]::Parse($_.timestamp) -gt $CutoffTime }

# Group by User to check for multiple distinct IPs/Countries
$SuspiciousUsers = $RecentLogs | Group-Object username | Where-Object { 
    $_.Group | Select-Object -ExpandProperty source_ip -Unique | Measure-Object | Select-Object -ExpandProperty Count -gt 2
}

if ($SuspiciousUsers) {
    Write-Host "[!!] ALERT: Found users with >2 distinct IPs in the last $HoursToScan hours:" -ForegroundColor Red
    $SuspiciousUsers | ForEach-Object {
        Write-Host "User: $($_.Name)" -ForegroundColor Yellow
        $Ips = $_.Group | Select-Object -ExpandProperty source_ip -Unique
        Write-Host "  IPs: $($Ips -join ', ')"
        
        # Action: Disable User (Uncomment to enforce)
        # Disable-ADAccount -Identity $_.Name
        # Write-Host "  Action: Account disabled." -ForegroundColor Red
    }
} else {
    Write-Host "[+] No immediate anomalies detected in IP diversity." -ForegroundColor Green
}

Write-Host "[*] Audit complete." -ForegroundColor Cyan