huntrule

Windows DLL Image Load Identified by Hashes for Compromised 3CXDesktopApp Components

Flags DLL loads in Windows when loaded module hashes match known compromised 3CXDesktopApp-related files.

FreeReviewedSigma · Critical · v5
Product
windows
Category
image_load
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-03-31
Updated
2026-07-31
AnalysisDetection

What it detects

This rule flags Windows image load events when the loaded DLL or related component matches a set of known file hashes associated with compromised 3CXDesktopApp artifacts. Attackers may rely on malicious DLLs or embedded components to execute code and persist within a legitimate application. The detection depends on image_load telemetry that includes file hash values (MD5/SHA1/SHA256) for the DLL being loaded.

Reporting behind it

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.