Void Dokkaebi - Discord/Telegram Webhook Exfiltration (T1041)
Detects scripts launched from developer directories (e.g., GitHub, GitLab, Bitbucket, or directories containing 'interview' in their path) that attempt to exfiltrate data by making network connections to Discord or Telegram API webhooks. This rule specifically looks for network events where the remote URL matches Discord or Telegram webhook patterns, and correlates them with process events where the initiating process's folder path suggests a developer-related or interview-related context.
Microsoft Sentinel (KQL)
