Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Infra-CDNMalwareStaging.
Upgrade to ProDetect Malware Payloads Staged on Abused Legitimate CDN/File-Sharing Services in Microsoft Sentinel
Loader-as-a-service operators and commodity infostealer distributors increasingly stage second- and third-stage payloads on trusted, high-reputation CDN and file-sharing infrastructure — most commonly Discord's attachment CDN (cdn.discordapp.com / media.discordapp.net), MEGA.nz, and Telegram's file API — rather than adversary-registered domains. Because these hostnames are broadly allowlisted by web filters, blend into ordinary user traffic, and offer free, effectively anonymous hosting with no registration paperwork, actors such as Storm-1113 (DarkGate loader distribution), Lumma Stealer, and Vidar operators use them as durable staging points for stage-2 payloads delivered via malvertising, cracked-software lures, and SEO-poisoned search results. Because the domain itself is never flagged as malicious, defenders must pivot detection away from domain reputation and onto the combination of requesting process, retrieved content-type, and download cadence. Detection focuses on three pillars: (1) non-browser processes (script hosts, LOLBins, unsigned binaries) issuing HTTPS requests to these CDN hostnames, (2) executable/archive content-types being retrieved from paths that are normally used for images/media, and (3) newly-created local files immediately following such a download that are then executed.
MITRE ATT&CK
- Tactic
- Resource Development
KQL Detection Query
// THREAT-Infra-CDNMalwareStaging (T1608.001) - Malware staged on abused legitimate CDN/file-sharing services
// Pillar 1: Non-browser process requesting Discord CDN / MEGA / Telegram file hosting
let StagingHosts = dynamic([
"cdn.discordapp.com", "media.discordapp.net", "discord.com",
"mega.nz", "mega.co.nz",
"api.telegram.org", "t.me"
]);
let BrowserProcesses = dynamic([
"chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe"
]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (StagingHosts)
| where InitiatingProcessFileName !in~ (BrowserProcesses)
| extend SuspicionReason = "NonBrowserProcessToCDN"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, SuspicionReason
| union (
// Pillar 2: Executable/archive retrieved via LOLBin from these hosts, followed by execution
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "curl.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| where ProcessCommandLine has_any (StagingHosts)
| where ProcessCommandLine has_any (".exe", ".dll", ".zip", ".rar", ".7z", "-outfile", "downloadfile")
| extend RemoteUrl = extract(@"(https?://[^\s\"']+)", 1, ProcessCommandLine)
| extend RemoteIP = "", SuspicionReason = "LOLBinPayloadDownload"
| project Timestamp, DeviceName, InitiatingProcessFileName=FileName, InitiatingProcessCommandLine=ProcessCommandLine, RemoteUrl, RemoteIP, SuspicionReason
)
| sort by Timestamp descTwo-pillar detection for adversary payload staging on abused legitimate CDN/file-sharing infrastructure. Pillar 1 flags any non-browser process (scripting engines, LOLBins, unsigned binaries) establishing a network connection to Discord CDN, MEGA, or Telegram file-hosting hostnames via DeviceNetworkEvents. Pillar 2 flags common LOLBins (powershell, certutil, bitsadmin, mshta) whose command line references those same hostnames alongside an executable/archive extension or a file-download cmdlet/flag, indicating an active payload retrieval rather than incidental traffic.
Data Sources
Required Tables
False Positives & Tuning
- Discord desktop/web client itself, or bots/integrations legitimately fetching attachments and avatars from cdn.discordapp.com
- IT-approved use of MEGA.nz or Telegram for legitimate file transfer/backup by employees or automation accounts
- Software update mechanisms or Electron apps (including Discord's own updater) that fetch assets from media.discordapp.net
- Security or IT tooling using certutil/bitsadmin for legitimate certificate or content retrieval that happens to traverse a matching hostname pattern
Other platforms for THREAT-Infra-CDNMalwareStaging
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Non-Browser Process Requesting Discord CDN Hostname
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents: outbound connection from powershell.exe to cdn.discordapp.com. Sysmon Event ID 11: file creation at atomic_test_dl.tmp immediately following the request.
- Test 2Certutil Payload-Style Retrieval Referencing Staging Host and Executable Extension
Expected signal: Sysmon Event ID 1: certutil.exe with -urlcache -split -f and a discordapp.com URL ending in .exe in CommandLine. Sysmon Event ID 3 for the outbound connection. Request will likely 404 but the command-line pattern and connection attempt are logged regardless.
- Test 3MSHTA Reference to MEGA File-Hosting Archive Path
Expected signal: Sysmon Event ID 1: mshta.exe with CommandLine containing 'mega.nz' and '.zip'. No actual network connection to MEGA occurs since the URL is embedded in an inert JavaScript comment, but the command-line telemetry is captured.
References (5)
- https://attack.mitre.org/techniques/T1608/001/
- https://attack.mitre.org/tactics/TA0042/
- https://www.microsoft.com/en-us/security/blog/2024/05/28/malware-distributor-storm-1113-uses-fake-cdn-landing-pages-to-lure-victims/
- https://www.trendmicro.com/en_us/research/23/discord-cdn-abuse-malware-delivery.html
- https://www.sophos.com/en-us/threat-center/threat-monitoring/threat-analyses/discord-content-delivery-network-abuse
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Infra-CDNMalwareStaging — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month