Malware Payloads Staged on Abused Legitimate CDN/File-Sharing Services

// THREAT-Infra-CDNMalwareStaging (T1608.001) - Malware staged on abused legitimate CDN/file-sharing services
// Pillar 1: Non-browser process requesting Discord CDN / MEGA / Telegram file hosting
let StagingHosts = dynamic([
  "cdn.discordapp.com", "media.discordapp.net", "discord.com",
  "mega.nz", "mega.co.nz",
  "api.telegram.org", "t.me"
]);
let BrowserProcesses = dynamic([
  "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe"
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (StagingHosts)
| where InitiatingProcessFileName !in~ (BrowserProcesses)
| extend SuspicionReason = "NonBrowserProcessToCDN"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, SuspicionReason
| union (
    // Pillar 2: Executable/archive retrieved via LOLBin from these hosts, followed by execution
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("powershell.exe", "curl.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
    | where ProcessCommandLine has_any (StagingHosts)
    | where ProcessCommandLine has_any (".exe", ".dll", ".zip", ".rar", ".7z", "-outfile", "downloadfile")
    | extend RemoteUrl = extract(@"(https?://[^\s\"']+)", 1, ProcessCommandLine)
    | extend RemoteIP = "", SuspicionReason = "LOLBinPayloadDownload"
    | project Timestamp, DeviceName, InitiatingProcessFileName=FileName, InitiatingProcessCommandLine=ProcessCommandLine, RemoteUrl, RemoteIP, SuspicionReason
)
| sort by Timestamp desc

| union
[
  search index=proxy OR index=network sourcetype="*proxy*" OR sourcetype="*firewall*"
  (url="*cdn.discordapp.com*" OR url="*media.discordapp.net*" OR url="*mega.nz*" OR url="*mega.co.nz*" OR url="*api.telegram.org*" OR url="*t.me*")
  | eval Process=coalesce(process_name, app, "unknown")
  | where NOT match(lower(Process), "chrome|msedge|firefox|brave|opera|iexplore|discord\.exe")
  | eval SuspicionReason="NonBrowserProcessToCDN"
  | table _time, host, user, Process, url, dest_ip, SuspicionReason
]
[
  search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image IN ("*\\powershell.exe", "*\\curl.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\bitsadmin.exe")
  (CommandLine="*discordapp*" OR CommandLine="*mega.nz*" OR CommandLine="*mega.co.nz*" OR CommandLine="*telegram.org*" OR CommandLine="*t.me*")
  (CommandLine="*.exe*" OR CommandLine="*.dll*" OR CommandLine="*.zip*" OR CommandLine="*.rar*" OR CommandLine="*.7z*" OR CommandLine="*-outfile*" OR CommandLine="*downloadfile*")
  | eval SuspicionReason="LOLBinPayloadDownload"
  | table _time, host, User, Image, CommandLine, SuspicionReason
]
| sort - _time

sequence by host.name with maxspan=2m
[
  network where event.type == "connection" and network.direction == "outbound" and
    destination.domain : ("cdn.discordapp.com", "media.discordapp.net", "mega.nz", "mega.co.nz", "api.telegram.org", "t.me") and
    not process.name : ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "Discord.exe")
]
[
  file where event.type == "creation" and
    file.extension : ("exe", "dll", "zip", "rar", "7z")
]

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip, destinationip,
  "Image" AS Process, "CommandLine", "URL" AS RequestedUrl,
  CASE
    WHEN "URL" ILIKE '%.exe%' OR "URL" ILIKE '%.zip%' OR "URL" ILIKE '%.dll%' THEN 75
    ELSE 55
  END AS RiskScore
FROM events
WHERE
  ("URL" ILIKE '%cdn.discordapp.com%' OR "URL" ILIKE '%media.discordapp.net%'
   OR "URL" ILIKE '%mega.nz%' OR "URL" ILIKE '%mega.co.nz%'
   OR "URL" ILIKE '%telegram.org%' OR "URL" ILIKE '%t.me%')
  AND "Image" NOT ILIKE '%chrome.exe%'
  AND "Image" NOT ILIKE '%msedge.exe%'
  AND "Image" NOT ILIKE '%firefox.exe%'
  AND "Image" NOT ILIKE '%discord.exe%'
  AND LOGSOURCETYPENAME(devicetype) ILIKE '%proxy%'
ORDER BY RiskScore DESC
LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*sysmon*
| json auto
| where url matches "*cdn.discordapp.com*" or url matches "*media.discordapp.net*" or url matches "*mega.nz*" or url matches "*telegram.org*" or url matches "*t.me*"
| eval ProcessName = lower(coalesce(process_name, Image, "unknown"))
| where !matches(ProcessName, "chrome|msedge|firefox|brave|opera|discord\.exe")
| eval IsPayloadExt = if(matches(url, "\.(exe|dll|zip|rar|7z)"), "true", "false")
| eval RiskScore = if(IsPayloadExt = "true", 75, 55)
| where RiskScore >= 55
| stats count as Requests, values(url) as SampleUrls by _sourceHost, ProcessName, RiskScore
| sort by RiskScore desc

rule cdn_malware_staging_abuse {
  meta:
    author = "Detection Engineering"
    description = "Detects non-browser processes retrieving payload-style content from abused legitimate CDN/file-hosting infrastructure"
    severity = "HIGH"
    confidence = "medium"
    mitre_attack = "T1608.001"
    reference = "https://attack.mitre.org/techniques/T1608/001/"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "GET"
    re.regex($e.target.url, `(?i)(cdn\.discordapp\.com|media\.discordapp\.net|mega\.nz|mega\.co\.nz|api\.telegram\.org|t\.me)`)
    not re.regex($e.principal.process.file.full_path, `(?i)(chrome|msedge|firefox|brave|opera|discord)\.exe`)

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=DnsRequest
| RemoteAddressIP4 != null
| ParentBaseFileName != /(?i)(chrome|msedge|firefox|brave|opera|discord)\.exe/
| DomainName = /(?i)(discordapp\.com|discordapp\.net|mega\.nz|mega\.co\.nz|telegram\.org|t\.me)/
| groupBy([aid, ComputerName, ParentBaseFileName, DomainName], function=[count(as=ConnCount), min(timestamp, as=FirstSeen)])
| case {
    ConnCount >= 3 => RiskScore := "High";
    * => RiskScore := "Medium";
  }
| table([ComputerName, ParentBaseFileName, DomainName, ConnCount, RiskScore, FirstSeen])
| sort(RiskScore)