YARA · SecuInfra Falcon Team

SECUINFRA_SUSP_Discord_Attachments_URL

Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

What this rule detects

Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

Targets: Windows PE.

It defines 1 patterns (1 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: bf81920b-f8ab-594a-aa45-d92446411113

version	0.1

SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_OBFUS_Powershell_ExecutionMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27