Windows DNS Queries Matching 3CXDesktopApp Compromise-Related Beaconing Domains

title: Windows DNS Queries Matching 3CXDesktopApp Compromise-Related Beaconing Domains
id: 86a3c679-bf53-409d-b003-908175c55e2f
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: derived
status: test
description: This rule flags DNS queries whose names contain specific domains associated with potential beaconing activity tied to a 3CXDesktopApp compromise scenario. Attackers frequently use recurring outbound DNS lookups to maintain command-and-control communication while blending into normal name resolution. The detection relies on Windows DNS query telemetry and matches on the queried domain name substrings.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/dns_query_win_malware_3cx_compromise.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
modified: 2023-03-31
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains:
      - akamaicontainer.com
      - akamaitechcloudservices.com
      - azuredeploystore.com
      - azureonlinecloud.com
      - azureonlinestorage.com
      - dunamistrd.com
      - glcloudservice.com
      - journalide.org
      - msedgepackageinfo.com
      - msedgeupdate.net
      - msstorageazure.com
      - msstorageboxes.com
      - officeaddons.com
      - officestoragebox.com
      - pbxcloudeservices.com
      - pbxphonenetwork.com
      - pbxsources.com
      - qwepoi123098.com
      - sbmsa.wiki
      - sourceslabs.com
      - visualstudiofactory.com
      - zacharryblogs.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1