Emerging Threathightest

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Wed Mar 29Updated Fri Mar 31bd03a0dc-5d93-49eb-b2e8-2dfd268600f82023
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsDNS Query
ProductWindows← raw: windows
CategoryDNS Query← raw: dns_query

DNS lookup events generated by endpoint monitoring tools.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        QueryName|contains:
            - 'akamaicontainer.com'
            - 'akamaitechcloudservices.com'
            - 'azuredeploystore.com'
            - 'azureonlinecloud.com'
            - 'azureonlinestorage.com'
            - 'dunamistrd.com'
            - 'glcloudservice.com'
            - 'journalide.org'
            - 'msedgepackageinfo.com'
            - 'msedgeupdate.net'
            - 'msstorageazure.com'
            - 'msstorageboxes.com'
            - 'officeaddons.com'
            - 'officestoragebox.com'
            - 'pbxcloudeservices.com'
            - 'pbxphonenetwork.com'
            - 'pbxsources.com'
            - 'qwepoi123098.com'
            - 'sbmsa.wiki'
            - 'sourceslabs.com'
            - 'visualstudiofactory.com'
            - 'zacharryblogs.com'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

MITRE ATT&CK

Other

detection.emerging-threats
Related Rules
SimilarEmerging Threathigh

Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threathigh

Potential Compromised 3CXDesktopApp ICO C2 File Download

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threathigh

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threathigh

Potential Compromised 3CXDesktopApp Execution

Detects execution of known compromised version of 3CXDesktopApp

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threathigh

Potential Suspicious Child Process Of 3CXDesktopApp

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threathigh

Potential Compromised 3CXDesktopApp Update Activity

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

Detects similar activity. Both rules may fire on overlapping events.

SimilarEmerging Threatcritical

Malicious DLL Load By Compromised 3CXDesktopApp

Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
Status
test
Level
high
Type
Emerging Threat
Created
Wed Mar 29
Modified
Fri Mar 31
Path
rules-emerging-threats/2023/TA/3CX-Supply-Chain/dns_query_win_malware_3cx_compromise.yml
Raw Tags
attack.command-and-controldetection.emerging-threats
View on GitHub