Windows Process Creation: 3CXDesktopApp updater fetching known compromised update URL

Alerts on 3CXDesktopApp updater.exe launched with update arguments pointing to a known compromised HTTP update path.

FreeUnreviewedSigmahighv1

windows-process-creation-3cxdesktopapp-updater-fetching-known-compromised-update-e7581747

title: "Windows Process Creation: 3CXDesktopApp updater fetching known compromised update URL"
id: 276d3b9c-637d-4e31-8067-70944f8fb6d9
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: derived
status: test
description: This rule flags Windows process creation events where the 3CXDesktopApp updater (update.exe) is started with arguments indicating it is downloading an update from a specific HTTP path that targets the version string shown in the command line. Such updater-driven downloads matter because they can align with supply-chain style compromise where malware is delivered via legitimate update mechanisms. It relies on process creation telemetry including the image path and the full command line arguments.
references:
  - https://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/
  - https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_update.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \3CXDesktopApp\app\update.exe
    CommandLine|contains|all:
      - --update
      - http
      - /electron/update/win32/18.12
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the 3CXDesktopApp updater (update.exe) is started with arguments indicating it is downloading an update from a specific HTTP path that targets the version string shown in the command line. Such updater-driven downloads matter because they can align with supply-chain style compromise where malware is delivered via legitimate update mechanisms. It relies on process creation telemetry including the image path and the full command line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.