huntrule

Windows DLL Load Triggered by Known Compromised 3CXDesktopApp Module Hashes

Flags DLL loads in Windows when loaded module hashes match known compromised 3CXDesktopApp-related files.

FreeUnreviewedSigmacriticalv1
title: Windows DLL Load Triggered by Known Compromised 3CXDesktopApp Module Hashes
id: 9809140e-b9d6-4094-89f5-caada5394b39
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: derived
status: test
description: This rule identifies Windows image_load events where the loaded DLL matches SHA256/SHA1/MD5 hashes of known compromised components associated with 3CXDesktopApp compromise activity. Attackers often rely on DLL loading to execute malicious code within a legitimate process while minimizing overt artifacts. The detection depends on telemetry that records DLL image loads and the ability to match observed file hashes against the provided known-bad values.
references:
  - https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/image_load_malware_3cx_compromise_susp_dll.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-31
modified: 2024-11-23
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Hashes|contains:
      - SHA256=7986BBAEE8940DA11CE089383521AB420C443AB7B15ED42AED91FD31CE833896
      - SHA1=BF939C9C261D27EE7BB92325CC588624FCA75429
      - MD5=74BC2D0B6680FAA1A5A76B27E5479CBC
      - SHA256=11BE1803E2E307B647A8A7E02D128335C448FF741BF06BF52B332E0BBF423B03
      - SHA1=20D554A80D759C50D6537DD7097FED84DD258B3E
      - MD5=82187AD3F0C6C225E2FBA0C867280CC9
      - SHA256=F79C3B0ADB6EC7BCC8BC9AE955A1571AAED6755A28C8B17B1D7595EE86840952
      - SHA1=894E7D4FFD764BB458809C7F0643694B036EAD30
      - MD5=11BC82A9BD8297BD0823BCE5D6202082
      - SHA256=8AB3A5EAAF8C296080FADF56B265194681D7DA5DA7C02562953A4CB60E147423
      - SHA1=3B3E778B647371262120A523EB873C20BB82BEAF
      - MD5=7FAEA2B01796B80D180399040BB69835
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1

What it detects

This rule identifies Windows image_load events where the loaded DLL matches SHA256/SHA1/MD5 hashes of known compromised components associated with 3CXDesktopApp compromise activity. Attackers often rely on DLL loading to execute malicious code within a legitimate process while minimizing overt artifacts. The detection depends on telemetry that records DLL image loads and the ability to match observed file hashes against the provided known-bad values.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.