huntrule

Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

FreeReviewedSigma · High · v5
Product
windows
Category
dns_query
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-03-29
Updated
2026-07-31
AnalysisDetection

What it detects

This rule flags DNS queries whose QueryName contains domains associated with potential 3CXDesktopApp compromise activity. Attackers commonly use repeated outbound name resolutions to reach command-and-control infrastructure, so these specific domain indicators can help identify suspicious beaconing. It relies on Windows DNS query telemetry, matching the queried domain strings against a defined list.

Reporting behind it

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.