huntrule

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

FreeReviewedSigma · High · v5
Category
proxy
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-03-29
Updated
2026-07-31
AnalysisDetection
title: Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise
id: 5c619784-8cb2-4d6a-8aa1-b99c049c83e7
related:
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: derived
status: test
description: This rule flags proxy traffic where the destination host contains known domains associated with potential 3CXDesktopApp compromise and subsequent beaconing behavior. Attackers commonly use outbound HTTP/S requests to periodically signal to command-and-control infrastructure, making this pattern useful for early compromise triage. It relies on proxy logs that include the requested host (cs-host) matching any of the specified domain substrings.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_c2_beacon_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
modified: 2023-05-18
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains:
      - akamaicontainer.com
      - akamaitechcloudservices.com
      - azuredeploystore.com
      - azureonlinecloud.com
      - azureonlinestorage.com
      - dunamistrd.com
      - glcloudservice.com
      - journalide.org
      - msedgepackageinfo.com
      - msstorageazure.com
      - msstorageboxes.com
      - officeaddons.com
      - officestoragebox.com
      - pbxcloudeservices.com
      - pbxphonenetwork.com
      - pbxsources.com
      - qwepoi123098.com
      - sbmsa.wiki
      - sourceslabs.com
      - visualstudiofactory.com
      - zacharryblogs.com
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1