TokenGrabber Stealer: Discord LevelDB Token Theft and API Validation
Detects unauthorized processes attempting to access Discord's local storage (LevelDB) where authentication tokens are stored, followed by a network request to the Discord API user validation endpoint, which is a pattern indicative of token extraction and liveness testing by malware.
Microsoft Sentinel (KQL)
