Discord download invoked from cmd line (ASIM Version)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.

Attribute Value
Type Hunting Query
Solution Standalone Content
ID 3169dc83-9e97-452c-afcc-baebdb0ddf7c
Tactics Execution, CommandAndControl, Exfiltration
Techniques T1204, T1102, T1567
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries