Discord, like many Electron desktop applications, stores its session state in a Chromium-style profile under the user’s application data folder, with the token in the Local Storage\leveldb files. Stealers read those files directly, and the same pattern applies to Slack, Teams and Telegram desktop profiles. A token is a bearer credential, so theft bypasses the password entirely.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| Non-Discord process reads Local Storage leveldb files under a Discord profile | EDR file access, Security 4663 | T1528 |
| Same process sweeps Discord, Canary, PTB and several browser leveldb paths | EDR | T1528 |
| Local State read from the Discord profile (key for encrypted token values) | EDR, Security 4663 | T1555 |
| Process requests Discord API endpoints from an unusual binary | Proxy, DNS, EDR network | T1550.001 |
| Outbound webhook post to Discord from a non-Discord process | Proxy, DNS | T1567 |
Profile Paths to Watch
Discord ships as several release channels, each with its own profile folder under the roaming application data directory, and browsers keep their own leveldb stores that stealers sweep in the same pass. Define one rule over all of them and allowlist the owning application. The Sigma logic below expects a file-read source; map the logsource to your EDR’s file-access telemetry:
title: Non-Owner Read of Discord Local Storage leveldb
logsource:
category: file_access # map to your EDR file-read telemetry
product: windows
detection:
selection:
TargetFilename|contains|all:
- '\Local Storage\leveldb\'
TargetFilename|contains:
- '\discord\'
- '\discordcanary\'
- '\discordptb\'
filter_owner:
Image|endswith:
- '\Discord.exe'
- '\DiscordCanary.exe'
- '\DiscordPTB.exe'
- '\Update.exe'
condition: selection and not filter_owner
level: high
# tune/validate: add AV, EDR and backup agents by full path
Hunting and Response
If you only have Windows auditing, the same logic runs on event 4663 once a SACL covers the leveldb directories:
index=wineventlog EventCode=4663 ObjectName="*\\Local Storage\\leveldb\\*"
(ObjectName="*\\discord*" OR ObjectName="*\\Slack\\*" OR ObjectName="*\\Telegram Desktop\\*")
NOT (ProcessName="*\\Discord.exe" OR ProcessName="*\\slack.exe" OR ProcessName="*\\Telegram.exe")
| stats count values(ObjectName) AS files BY host, SubjectUserName, ProcessName
| where count > 3
`comment("tune/validate: field names depend on your Splunk Windows TA version")`
- Corporate exposure is usually Slack, Teams and developer tooling rather than Discord. Extend the path list to every Electron application that holds a work session.
- After a hit, log the user out of the application everywhere, rotate the token or password, and review audit logs for that account.
- Block outbound Discord webhook posts from non-Discord processes if you do not use them; they are a common stealer exfil channel.
Use SigmaHQ file-access and credential-access rules, Elastic detections for application token theft and the MITRE ATT&CK T1528 page. Application storage layouts change between versions, so verify the paths on a current install before deploying, and baseline legitimate readers.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts