← Back to SOC feed Coverage →

Discord download invoked from cmd line (ASIM Version)

kql MEDIUM Azure-Sentinel
T1204T1102T1567
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-21T09:00:00Z · Confidence: medium

Hunt Hypothesis

Hosts executing commands to interact with the Discord CDN via the command line may indicate adversarial C2 activity or exfiltration, as this behavior deviates from normal usage patterns. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential malware or persistent access mechanisms leveraging Discord infrastructure.

KQL Query

imProcess
  | where Process has_any ("powershell.exe", "powershell_ise.exe", "cmd.exe") or CommandLine has "powershell"
  | where CommandLine has_any ("cdn.discordapp.com", "moc.ppadrocsid.ndc")
  | project-reorder TimeGenerated, Dvc, User, Process, CommandLine
  | extend NTDomain = tostring(split(User,'\\',0)[0]), Name = tostring(split(User,'\\',1)[0])
  | extend HostName = tostring(split(Dvc, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Dvc, '.'), 1, -1), '.'))
  | extend Account_0_Name = Name
  | extend Account_0_NTDomain = NTDomain
  | extend Host_0_HostName = HostName
  | extend Host_0_DnsDomain = DnsDomain

Analytic Rule Definition

id: 3169dc83-9e97-452c-afcc-baebdb0ddf7c
name: Discord download invoked from cmd line (ASIM Version)
description: |
  'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
requiredDataConnectors: []
tactics:
  - Execution
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1204
  - T1102
  - T1567
query: |
  imProcess
    | where Process has_any ("powershell.exe", "powershell_ise.exe", "cmd.exe") or CommandLine has "powershell"
    | where CommandLine has_any ("cdn.discordapp.com", "moc.ppadrocsid.ndc")
    | project-reorder TimeGenerated, Dvc, User, Process, CommandLine
    | extend NTDomain = tostring(split(User,'\\',0)[0]), Name = tostring(split(User,'\\',1)[0])
    | extend HostName = tostring(split(Dvc, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Dvc, '.'), 1, -1), '.'))
    | extend Account_0_Name = Name
    | extend Account_0_NTDomain = NTDomain
    | extend Host_0_HostName = HostName
    | extend Host_0_DnsDomain = DnsDomain
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
version: 1.0.1
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/ASimProcess/Discorddownloadinvokedfromcmdline(ASIMVersion).yaml