Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Infra-CDNMalwareStaging.
Upgrade to ProDetect Malware Payloads Staged on Abused Legitimate CDN/File-Sharing Services in Splunk
Loader-as-a-service operators and commodity infostealer distributors increasingly stage second- and third-stage payloads on trusted, high-reputation CDN and file-sharing infrastructure — most commonly Discord's attachment CDN (cdn.discordapp.com / media.discordapp.net), MEGA.nz, and Telegram's file API — rather than adversary-registered domains. Because these hostnames are broadly allowlisted by web filters, blend into ordinary user traffic, and offer free, effectively anonymous hosting with no registration paperwork, actors such as Storm-1113 (DarkGate loader distribution), Lumma Stealer, and Vidar operators use them as durable staging points for stage-2 payloads delivered via malvertising, cracked-software lures, and SEO-poisoned search results. Because the domain itself is never flagged as malicious, defenders must pivot detection away from domain reputation and onto the combination of requesting process, retrieved content-type, and download cadence. Detection focuses on three pillars: (1) non-browser processes (script hosts, LOLBins, unsigned binaries) issuing HTTPS requests to these CDN hostnames, (2) executable/archive content-types being retrieved from paths that are normally used for images/media, and (3) newly-created local files immediately following such a download that are then executed.
MITRE ATT&CK
- Tactic
- Resource Development
SPL Detection Query
| union
[
search index=proxy OR index=network sourcetype="*proxy*" OR sourcetype="*firewall*"
(url="*cdn.discordapp.com*" OR url="*media.discordapp.net*" OR url="*mega.nz*" OR url="*mega.co.nz*" OR url="*api.telegram.org*" OR url="*t.me*")
| eval Process=coalesce(process_name, app, "unknown")
| where NOT match(lower(Process), "chrome|msedge|firefox|brave|opera|iexplore|discord\.exe")
| eval SuspicionReason="NonBrowserProcessToCDN"
| table _time, host, user, Process, url, dest_ip, SuspicionReason
]
[
search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image IN ("*\\powershell.exe", "*\\curl.exe", "*\\wscript.exe", "*\\cscript.exe", "*\\mshta.exe", "*\\certutil.exe", "*\\bitsadmin.exe")
(CommandLine="*discordapp*" OR CommandLine="*mega.nz*" OR CommandLine="*mega.co.nz*" OR CommandLine="*telegram.org*" OR CommandLine="*t.me*")
(CommandLine="*.exe*" OR CommandLine="*.dll*" OR CommandLine="*.zip*" OR CommandLine="*.rar*" OR CommandLine="*.7z*" OR CommandLine="*-outfile*" OR CommandLine="*downloadfile*")
| eval SuspicionReason="LOLBinPayloadDownload"
| table _time, host, User, Image, CommandLine, SuspicionReason
]
| sort - _timeTwo-source detection combining web proxy/firewall telemetry (for non-browser access to Discord CDN, MEGA, or Telegram file hosting) with Sysmon Event ID 1 (for LOLBin command lines that both reference one of these hosts and reference an executable/archive extension or download flag). Requires a proxy or firewall log source with URL visibility and Sysmon deployed with command-line logging enabled.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Discord client and its auto-updater fetching legitimate attachments and application assets
- Approved employee or automation use of MEGA/Telegram for legitimate file transfer
- Internal scripts using certutil/bitsadmin against an internal mirror whose hostname happens to substring-match a matched pattern
- Security awareness or IT training material referencing these hosting services in documentation retrieval scripts
Other platforms for THREAT-Infra-CDNMalwareStaging
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Non-Browser Process Requesting Discord CDN Hostname
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents: outbound connection from powershell.exe to cdn.discordapp.com. Sysmon Event ID 11: file creation at atomic_test_dl.tmp immediately following the request.
- Test 2Certutil Payload-Style Retrieval Referencing Staging Host and Executable Extension
Expected signal: Sysmon Event ID 1: certutil.exe with -urlcache -split -f and a discordapp.com URL ending in .exe in CommandLine. Sysmon Event ID 3 for the outbound connection. Request will likely 404 but the command-line pattern and connection attempt are logged regardless.
- Test 3MSHTA Reference to MEGA File-Hosting Archive Path
Expected signal: Sysmon Event ID 1: mshta.exe with CommandLine containing 'mega.nz' and '.zip'. No actual network connection to MEGA occurs since the URL is embedded in an inert JavaScript comment, but the command-line telemetry is captured.
References (5)
- https://attack.mitre.org/techniques/T1608/001/
- https://attack.mitre.org/tactics/TA0042/
- https://www.microsoft.com/en-us/security/blog/2024/05/28/malware-distributor-storm-1113-uses-fake-cdn-landing-pages-to-lure-victims/
- https://www.trendmicro.com/en_us/research/23/discord-cdn-abuse-malware-delivery.html
- https://www.sophos.com/en-us/threat-center/threat-monitoring/threat-analyses/discord-content-delivery-network-abuse
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Infra-CDNMalwareStaging — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month