huntrule

Suspicious Child Process Spawned by 3CXDesktopApp via Supply Chain Compromise

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-07-15
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Initial Access → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the 3CXDesktopApp.exe process spawning a command interpreter such as cmd.exe or powershell.exe. During the 3CX supply chain compromise the trojanized client executed follow-on commands to profile the host and retrieve second-stage payloads after sideloading a malicious ffmpeg.dll. The VoIP client has no legitimate reason to launch shells.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange
Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)
Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)
Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)
Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)
Suspicious shfolder.dll Sideloading via VMware net-service Binary
Suspicious AtlasRAT Loader Artifacts in Public Documents (via file_event)
Suspicious Commonly-Hijacked DLL Loaded From a User-Writable Path (via image_load)
Suspicious Impact of 'SMOKEDHAM Backdoor' with MSDTC Service Privilege Escalation via Command Line (via process_creation)
Malicious DLL ServerLevelPluginDll Command Installation (via process_creation)
Suspicious Child Process Spawned by 3CXDesktopApp via Supply Chain Compromise
Pivot detection · T1574.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.