Proxy web requests downloading .ICO from 3CXDesktopApp icon storage (potential C2 payload)

title: Proxy web requests downloading .ICO from 3CXDesktopApp icon storage (potential C2 payload)
id: 64cdbce0-6e56-41b6-b93d-9ce16753195f
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: derived
status: test
description: This rule flags proxy web requests whose URI contains 3CXDesktopApp icon storage paths and ends with a .ico file extension, suggesting a suspicious ICO payload delivery. Attackers may abuse the reputation or distribution patterns of legitimate application resources to retrieve malicious files. It relies on proxy telemetry that records requested URLs and matches the presence of specific URI path fragments and the .ico indicator.
references:
  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
  - https://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-31
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains|all:
      - IconStorages/images/main/icon
      - .ico
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1