Windows Non Discord App Access Discord LevelDB

Status: production
Severity: low
Group by: dest, object_file_name, process_id, process_name, signature_id, target_filename
Author: Teoderick Contreras, Splunk
Source: github.com/splunk/security_content

The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.

Known false positives

No false positives have been identified at this time.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1012` Query Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

name: Windows Non Discord App Access Discord LevelDB
id: 1166360c-d495-45ac-87a6-8948aac1fa07
version: 11
creation_date: '2024-02-22'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\discord\\Local Storage\\leveldb*") AND process_name != *\\discord.exe AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_non_discord_app_access_discord_leveldb_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: No false positives have been identified at this time.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A non-discord process $process_name$ accessing discord "leveldb" file on $dest$
analytic_story:
    - StealC Stealer
    - Snake Keylogger
    - PXA Stealer
    - BlankGrabber Stealer
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1012
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

Stages and Predicates

Stage 1: `search`

`wineventlog_security` EventCode=4663 object_file_path IN ("*\\discord\\Local Storage\\leveldb*") AND process_name != *\\discord.exe AND NOT (process_path IN ("*:\\Windows\\System32\\*", "*:\\Windows\\SysWow64\\*", "*:\\Program Files*", "*:\\Windows\\*"))

Stage 2: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest

Stage 3: `search`

| `security_content_ctime(firstTime)`

Stage 4: `search`

| `security_content_ctime(lastTime)`

Stage 5: `search`

| `windows_non_discord_app_access_discord_leveldb_filter`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`process_path`	in	`":\\Program Files"`, `":\\Windows\\"`, `":\\Windows\\SysWow64\\"`, `":\\Windows\\System32\\"`	`excludes:process_path`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4663` corpus 35 (splunk 30, kusto 5)	`field:"EventID" kind:eq value:"4663"`
`object_file_path`	in	`"\\discord\\Local Storage\\leveldb"`	`field:"TargetFilename" kind:in`
`process_name`	ne	`*\\discord.exe`	`field:"process_name" kind:ne value:"*\\discord.exe"`