Proxy Logs: Potential Beaconing to 3CX-Related Domains

title: "Proxy Logs: Potential Beaconing to 3CX-Related Domains"
id: 5c619784-8cb2-4d6a-8aa1-b99c049c83e7
related:
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: derived
status: test
description: This rule identifies proxy activity where the destination host matches a set of domains associated with potential 3CXDesktopApp compromise activity. Attackers may use beaconing to maintain command-and-control communication and stage follow-on actions. The detection relies on proxy telemetry that records outbound requests and uses host-name substring matching to flag relevant destinations.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_c2_beacon_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
modified: 2023-05-18
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains:
      - akamaicontainer.com
      - akamaitechcloudservices.com
      - azuredeploystore.com
      - azureonlinecloud.com
      - azureonlinestorage.com
      - dunamistrd.com
      - glcloudservice.com
      - journalide.org
      - msedgepackageinfo.com
      - msstorageazure.com
      - msstorageboxes.com
      - officeaddons.com
      - officestoragebox.com
      - pbxcloudeservices.com
      - pbxphonenetwork.com
      - pbxsources.com
      - qwepoi123098.com
      - sbmsa.wiki
      - sourceslabs.com
      - visualstudiofactory.com
      - zacharryblogs.com
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1