KQL Search

Query Details

HomeAI ToolsDevice Query

Discord Invite Hijacking Detection

Query

// Discord Invite Hijacking Detection
// https://darkatlas.io/blog/discord-invite-hijacking-how-fake-links-are-delivering-infostealers

let QueryPeriod = 1h;
let MonitorURLs = dynamic(["discord.com","discord.gg"]);
let DiscordAccess =
DeviceNetworkEvents
| where Timestamp > ago(QueryPeriod)
| where isnotempty(RemoteUrl)
| where ActionType == @"ConnectionSuccess"
| where RemoteUrl has_any (MonitorURLs)
| distinct DeviceName;
DeviceNetworkEvents
| where Timestamp > ago(QueryPeriod)
| where isnotempty(RemoteUrl)
| where ActionType == @"ConnectionSuccess"
| where DeviceName has_any(DiscordAccess) and RemoteUrl =~ "captchaguard.me"

Explanation

This query is designed to detect potential Discord invite hijacking attempts by monitoring network events on devices. Here's a simplified explanation of what it does:

  1. Define Monitoring Period and URLs:

    • It sets a monitoring period of the last hour (1h) and specifies two URLs to monitor: discord.com and discord.gg.

  2. Identify Devices Accessing Discord:

    • It looks at network events from devices that have successfully connected to any of the specified Discord URLs within the last hour.
    • It collects a list of unique device names that have made these successful connections.

  3. Detect Suspicious Activity:

    • It then checks network events again within the last hour for any of these devices.
    • It specifically looks for successful connections to the URL captchaguard.me, which is suspicious in this context.

The query essentially identifies devices that have accessed Discord and then checks if those same devices have also accessed a potentially malicious URL (captchaguard.me) within the same timeframe, which could indicate an attempt to hijack Discord invites.

Details

Steven Lim profile picture

Steven Lim

Released: June 15, 2025

Tables

DeviceNetworkEvents

Keywords

DeviceNetworkEventsTimestampRemoteUrlActionTypeDeviceName

Operators

letdynamicago()isnotempty()has_any()distinctand=~

Actions