huntrule

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

FreeReviewedSigma · High · v5
Category
proxy
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-03-29
Updated
2026-07-31
AnalysisDetection

What it detects

This rule flags proxy traffic where the destination host contains known domains associated with potential 3CXDesktopApp compromise and subsequent beaconing behavior. Attackers commonly use outbound HTTP/S requests to periodically signal to command-and-control infrastructure, making this pattern useful for early compromise triage. It relies on proxy logs that include the requested host (cs-host) matching any of the specified domain substrings.

Reporting behind it

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.