Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Infra-CDNMalwareStaging.
Upgrade to ProDetect Malware Payloads Staged on Abused Legitimate CDN/File-Sharing Services in Elastic Security
Loader-as-a-service operators and commodity infostealer distributors increasingly stage second- and third-stage payloads on trusted, high-reputation CDN and file-sharing infrastructure — most commonly Discord's attachment CDN (cdn.discordapp.com / media.discordapp.net), MEGA.nz, and Telegram's file API — rather than adversary-registered domains. Because these hostnames are broadly allowlisted by web filters, blend into ordinary user traffic, and offer free, effectively anonymous hosting with no registration paperwork, actors such as Storm-1113 (DarkGate loader distribution), Lumma Stealer, and Vidar operators use them as durable staging points for stage-2 payloads delivered via malvertising, cracked-software lures, and SEO-poisoned search results. Because the domain itself is never flagged as malicious, defenders must pivot detection away from domain reputation and onto the combination of requesting process, retrieved content-type, and download cadence. Detection focuses on three pillars: (1) non-browser processes (script hosts, LOLBins, unsigned binaries) issuing HTTPS requests to these CDN hostnames, (2) executable/archive content-types being retrieved from paths that are normally used for images/media, and (3) newly-created local files immediately following such a download that are then executed.
MITRE ATT&CK
- Tactic
- Resource Development
Elastic Detection Query
sequence by host.name with maxspan=2m
[
network where event.type == "connection" and network.direction == "outbound" and
destination.domain : ("cdn.discordapp.com", "media.discordapp.net", "mega.nz", "mega.co.nz", "api.telegram.org", "t.me") and
not process.name : ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "Discord.exe")
]
[
file where event.type == "creation" and
file.extension : ("exe", "dll", "zip", "rar", "7z")
]Sequence-based Elastic EQL detection correlating an outbound connection from a non-browser process to Discord CDN/MEGA/Telegram file-hosting hostnames, followed within 2 minutes by creation of an executable or archive file — the staging-to-drop pattern used by loader-as-a-service and infostealer distribution chains.
Data Sources
Required Tables
False Positives & Tuning
- Discord desktop client legitimately downloading update packages or cached attachments
- Employees or automation using MEGA/Telegram for approved file transfer that happens to download an archive shortly after
- Software installers that bundle CDN-hosted resources as part of a normal multi-file installation sequence
Other platforms for THREAT-Infra-CDNMalwareStaging
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Non-Browser Process Requesting Discord CDN Hostname
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents: outbound connection from powershell.exe to cdn.discordapp.com. Sysmon Event ID 11: file creation at atomic_test_dl.tmp immediately following the request.
- Test 2Certutil Payload-Style Retrieval Referencing Staging Host and Executable Extension
Expected signal: Sysmon Event ID 1: certutil.exe with -urlcache -split -f and a discordapp.com URL ending in .exe in CommandLine. Sysmon Event ID 3 for the outbound connection. Request will likely 404 but the command-line pattern and connection attempt are logged regardless.
- Test 3MSHTA Reference to MEGA File-Hosting Archive Path
Expected signal: Sysmon Event ID 1: mshta.exe with CommandLine containing 'mega.nz' and '.zip'. No actual network connection to MEGA occurs since the URL is embedded in an inert JavaScript comment, but the command-line telemetry is captured.
References (5)
- https://attack.mitre.org/techniques/T1608/001/
- https://attack.mitre.org/tactics/TA0042/
- https://www.microsoft.com/en-us/security/blog/2024/05/28/malware-distributor-storm-1113-uses-fake-cdn-landing-pages-to-lure-victims/
- https://www.trendmicro.com/en_us/research/23/discord-cdn-abuse-malware-delivery.html
- https://www.sophos.com/en-us/threat-center/threat-monitoring/threat-analyses/discord-content-delivery-network-abuse
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Infra-CDNMalwareStaging — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month