Emerging Threats
Actor2023

3CX Supply Chain

8Rules
6References
1Folders
2024-11-23Latest
Summary

3CX Supply Chain is tracked here as a threat actor, intrusion set, or campaign with 8 Sigma detections spanning 2023. Coverage centers on windows / process_creation, proxy, windows / dns_query +2.

Related Detections
Search this threat
Emerging Threatcriticaltest

Malicious DLL Load By Compromised 3CXDesktopApp

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

WindowsImage Load (DLL)
TA0005 · Stealthdetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Mar 312023
Emerging Threathightest

Potential Compromised 3CXDesktopApp Execution

Detects execution of known compromised version of 3CXDesktopApp

WindowsProcess Creation
TA0005 · StealthT1218 · System Binary Proxy ExecutionTA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
Emerging Threathightest

Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Proxy Log
TA0011 · Command and Controldetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
Emerging Threathightest

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

WindowsDNS Query
TA0011 · Command and Controldetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
Emerging Threathightest

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

WindowsNetwork Connection
TA0011 · Command and Controldetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
Emerging Threathightest

Potential Compromised 3CXDesktopApp ICO C2 File Download

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Proxy Log
TA0011 · Command and Controldetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Mar 312023
Emerging Threathightest

Potential Compromised 3CXDesktopApp Update Activity

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

WindowsProcess Creation
TA0005 · StealthT1218 · System Binary Proxy ExecutionTA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
Emerging Threathightest

Potential Suspicious Child Process Of 3CXDesktopApp

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

WindowsProcess Creation
TA0011 · Command and ControlTA0002 · ExecutionTA0005 · StealthT1218 · System Binary Proxy Execution+1
Nasreddine Bencherchali (Nextron Systems)Wed Mar 292023
References