• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Discord download invoked from cmd line (ASIM Version)

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•22

    'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'

    Microsoft Sentinel (KQL)

    Tags

    TA0002 - ExecutionT1204 - User ExecutionTA0011 - Command and ControlT1102 - Web ServiceTA0010 - ExfiltrationT1567 - Exfiltration Over Web ServiceT1086 - PowerShellT1059.001 - PowerShellS0106 - cmdT1059 - Command and Scripting InterpreterT1059.003 - Windows Command ShellCommand ExecutionPowershell Script ExecutionNetwork Connection OutboundData ExfiltrationWindowsWindows SysmonWindows Eventlog Powershellkqltactic:Executiontactic:CommandAndControltactic:Exfiltrationtechnique:T1204technique:T1102technique:T1567

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?