Windows Process Creation: Suspicious Child Processes Spawned by 3CXDesktopApp.exe

Alerts on suspicious execution utilities spawned by 3CXDesktopApp.exe via Windows process creation events.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-child-processes-spawned-by-3cxdesktopapp-exe-63f3605b

title: "Windows Process Creation: Suspicious Child Processes Spawned by 3CXDesktopApp.exe"
id: decc6870-9841-41d7-8302-d0c299fb6024
related:
  - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26
    type: similar
  - id: 76bc1601-9546-4b75-9419-06e0e8d10651
    type: similar
  - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8
    type: similar
  - id: 51eecf75-d069-43c7-9ea2-63f75499edd4
    type: similar
  - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
    type: similar
  - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a
    type: similar
  - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9
    type: similar
  - id: 63f3605b-979f-48c2-b7cc-7f90523fed88
    type: derived
status: test
description: This rule flags process executions where the parent process is 3CXDesktopApp.exe and the child process is one of several commonly abused script or execution utilities (cmd.exe, cscript.exe, mshta.exe, powershell.exe/pwsh.exe, regsvr32.exe, rundll32.exe, wscript.exe). Such parent/child relationships can indicate command-and-control or payload execution following a compromise of the 3CXDesktopApp supply chain. It relies on Windows process creation telemetry capturing parent image paths and the spawned child image paths.
references:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-29
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1218
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \3CXDesktopApp.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process executions where the parent process is 3CXDesktopApp.exe and the child process is one of several commonly abused script or execution utilities (cmd.exe, cscript.exe, mshta.exe, powershell.exe/pwsh.exe, regsvr32.exe, rundll32.exe, wscript.exe). Such parent/child relationships can indicate command-and-control or payload execution following a compromise of the 3CXDesktopApp supply chain. It relies on Windows process creation telemetry capturing parent image paths and the spawned child image paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.