Detect Infostealer Credential Exfiltration via Discord Webhook in Microsoft Sentinel

let DiscordWebhookRegex = @"discord(app)?\.com/api/webhooks/\d{17,20}/[A-Za-z0-9_-]{60,90}";
let CredFileNames = dynamic([
  "Login Data", "Login Data For Account", "Cookies", "Local State",
  "Web Data", "wallet.dat", "keystore.json", "Ledger Live"
]);
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "firefox.exe"]);
// Signal 1: a non-browser process creates a copy of a locked browser credential-store
// filename outside the live profile directory — the standard stealer technique for
// bypassing Chromium's SQLite file lock on "Login Data"/"Cookies"/"Web Data"
let StagedCredentialCopy = DeviceFileEvents
| where Timestamp > ago(2h)
| where ActionType == "FileCreated"
| where FileName in~ (CredFileNames)
| where FolderPath !has "User Data" and FolderPath !has "Mozilla"
| where FolderPath has_any (@"\Temp\", @"\AppData\Local\Temp", @"\ProgramData\", @"\AppData\Roaming\")
| where InitiatingProcessFileName !in~ (BrowserProcesses)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
// Signal 2: outbound HTTPS request whose path matches the Discord webhook API pattern
let DiscordWebhookPost = DeviceNetworkEvents
| where Timestamp > ago(2h)
| where RemoteUrl matches regex DiscordWebhookRegex
| project Timestamp, DeviceName, AccountName, RemoteUrl,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256, BytesSent, RemotePort;
// High-confidence: same device + same process image hash, staged credential copy
// followed within 15 minutes by a webhook POST
let CorrelatedTheft = StagedCredentialCopy
| join kind=inner (DiscordWebhookPost) on DeviceName, InitiatingProcessSHA256
| where Timestamp1 - Timestamp between (0min .. 15min)
| extend Signal = "CredentialTheftThenWebhookPost", RiskScore = 90
| project WebhookPostTime=Timestamp1, DeviceName, AccountName, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256,
    RemoteUrl, BytesSent, Signal, RiskScore;
// Lower-confidence standalone signal: any non-collaboration-client process posting
// directly to a Discord webhook path
let StandaloneWebhookPost = DiscordWebhookPost
| where InitiatingProcessFileName !in~ ("discord.exe", "slack.exe", "teams.exe", "chrome.exe", "msedge.exe")
| extend Signal = "StandaloneDiscordWebhookPost", RiskScore = 60
| project WebhookPostTime=Timestamp, DeviceName, AccountName, FileName="", FolderPath="",
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256,
    RemoteUrl, BytesSent, Signal, RiskScore;
union CorrelatedTheft, StandaloneWebhookPost
| sort by RiskScore desc, WebhookPostTime desc