Windows Network Connections from 3CXDesktopApp.exe to Known 3CX-Related C2 Domains

title: Windows Network Connections from 3CXDesktopApp.exe to Known 3CX-Related C2 Domains
id: fce0126e-06c9-4af6-90ab-44d3bdd66905
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: derived
status: test
description: This rule flags outbound network connections initiated by \\3CXDesktopApp.exe to destinations whose hostnames match a set of domains associated with potential 3CXDesktopApp compromise activity. Beaconing-style traffic to attacker-controlled infrastructure is commonly used to establish command-and-control and receive follow-on instructions. It relies on Windows network connection telemetry that includes the connecting process image path and the destination hostname fields.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/net_connection_win_malware_3cx_compromise_beaconing_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
modified: 2023-03-31
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \3CXDesktopApp.exe
    DestinationHostname|contains:
      - akamaicontainer.com
      - akamaitechcloudservices.com
      - azuredeploystore.com
      - azureonlinecloud.com
      - azureonlinestorage.com
      - dunamistrd.com
      - glcloudservice.com
      - journalide.org
      - msedgepackageinfo.com
      - msstorageazure.com
      - msstorageboxes.com
      - officeaddons.com
      - officestoragebox.com
      - pbxcloudeservices.com
      - pbxphonenetwork.com
      - pbxsources.com
      - qwepoi123098.com
      - sbmsa.wiki
      - sourceslabs.com
      - visualstudiofactory.com
      - zacharryblogs.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1