Possible ICO C2 File Downloads via Proxy: Compromised 3CXDesktopApp
Flags proxy requests for 3CXDesktopApp icon storage URIs ending in .ico, indicating potential malicious payload downloads.
FreeReviewedSigma · High · v5
- Category
- proxy
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-31
- Updated
- 2026-07-31
What it detects
This rule flags proxy web requests for .ICO files under the path IconStorages/images/main/icon, which may indicate a compromised 3CXDesktopApp distributing C2-related payloads. Attackers can leverage such file formats and application-like assets to deliver malicious components over normal web traffic. Telemetry relies on proxy request URL fields (c-uri) matching both the icon path and the .ico extension.
Reporting behind it
- sentinelone.comhttps://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- linkedin.comhttps://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-web-requests-downloading-ico-from-3cxdesktopapp-icon-storage-potential-c2--76bc1601
title: "Possible ICO C2 File Downloads via Proxy: Compromised 3CXDesktopApp"
id: 64cdbce0-6e56-41b6-b93d-9ce16753195f
related:
- id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
type: similar
- id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
type: similar
- id: 51eecf75-d069-43c7-9ea2-63f75499edd4
type: similar
- id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
type: similar
- id: 63f3605b-979f-48c2-b7cc-7f90523fed88
type: similar
- id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
type: similar
- id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
type: similar
- id: 76bc1601-9546-4b75-9419-06e0e8d10651
type: derived
status: test
description: This rule flags proxy web requests for .ICO files under the path IconStorages/images/main/icon, which may indicate a compromised 3CXDesktopApp distributing C2-related payloads. Attackers can leverage such file formats and application-like assets to deliver malicious components over normal web traffic. Telemetry relies on proxy request URL fields (c-uri) matching both the icon path and the .ico extension.
references:
- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- https://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-31
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
c-uri|contains|all:
- IconStorages/images/main/icon
- .ico
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1