Discord download invoked from cmd line (ASIM Version)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	3169dc83-9e97-452c-afcc-baebdb0ddf7c
Tactics	Execution, CommandAndControl, Exfiltration
Techniques	T1204, T1102, T1567
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/ASimProcess/Discorddownloadinvokedfromcmdline%28ASIMVersion%29.yaml)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries