Discord download invoked from cmd line (ASIM Version)

id: 3169dc83-9e97-452c-afcc-baebdb0ddf7c
name: Discord download invoked from cmd line (ASIM Version)
description: |
  'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
requiredDataConnectors: []
tactics:
  - Execution
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1204
  - T1102
  - T1567
query: |
  imProcess
    | where Process has_any ("powershell.exe", "powershell_ise.exe", "cmd.exe") or CommandLine has "powershell"
    | where CommandLine has_any ("cdn.discordapp.com", "moc.ppadrocsid.ndc")
    | project-reorder TimeGenerated, Dvc, User, Process, CommandLine
    | extend NTDomain = tostring(split(User,'\\',0)[0]), Name = tostring(split(User,'\\',1)[0])
    | extend HostName = tostring(split(Dvc, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Dvc, '.'), 1, -1), '.'))
    | extend Account_0_Name = Name
    | extend Account_0_NTDomain = NTDomain
    | extend Host_0_HostName = HostName
    | extend Host_0_DnsDomain = DnsDomain
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Name
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
version: 1.0.1
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]