huntrule

Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

FreeReviewedSigma · High · v5
Product
windows
Category
dns_query
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-03-29
Updated
2026-07-31
AnalysisDetection
title: "Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise"
id: 86a3c679-bf53-409d-b003-908175c55e2f
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: derived
status: test
description: This rule flags DNS queries whose QueryName contains domains associated with potential 3CXDesktopApp compromise activity. Attackers commonly use repeated outbound name resolutions to reach command-and-control infrastructure, so these specific domain indicators can help identify suspicious beaconing. It relies on Windows DNS query telemetry, matching the queried domain strings against a defined list.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/dns_query_win_malware_3cx_compromise.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
modified: 2023-03-31
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains:
      - akamaicontainer.com
      - akamaitechcloudservices.com
      - azuredeploystore.com
      - azureonlinecloud.com
      - azureonlinestorage.com
      - dunamistrd.com
      - glcloudservice.com
      - journalide.org
      - msedgepackageinfo.com
      - msedgeupdate.net
      - msstorageazure.com
      - msstorageboxes.com
      - officeaddons.com
      - officestoragebox.com
      - pbxcloudeservices.com
      - pbxphonenetwork.com
      - pbxsources.com
      - qwepoi123098.com
      - sbmsa.wiki
      - sourceslabs.com
      - visualstudiofactory.com
      - zacharryblogs.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1