External IP Discovery Followed by Discord Communication from Non-Browser Process
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Microsoft Sentinel (KQL)
