Sigma detection rules, expert-reviewed

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

Windows: Flag 3CXDesktopApp updater fetching a known compromised update URL

Alerts on 3CXDesktopApp updater.exe launched with update arguments pointing to a known compromised HTTP update path.

Windows Process Creation: Suspicious Child Executables Spawned by 3CXDesktopApp.exe

Alerts on suspicious execution utilities spawned by 3CXDesktopApp.exe via Windows process creation events.

Windows Process Creation: 3CXDesktopApp Execution from Known Compromised Hashes

Alerts when 3CXDesktopApp.exe executes on Windows with hash/version indicators matching known compromised binaries.

Windows 3CXDesktopApp.exe Beaconing to Suspicious 3CX-Related Domains (Netcon)

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Windows Defender Real-Time Protection Error or Restart (windefend Event 3002/3007)

Alerts on windefend events showing Defender Real-Time Protection feature errors (3002) or restarts (3007).

Windows Process Creation: Sysinternals PsSuspend Targeting msmpeng.exe

Alerts on execution of Sysinternals PsSuspend with command line referencing msmpeng.exe.

Windows Sysinternals PsSuspend Process Execution

Alerts on execution of Sysinternals PsSuspend on Windows via process creation events.

Windows DLL sideloading: iviewers.dll loaded from non-Windows Kits paths

Alerts on unexpected loads of iviewers.dll outside Windows Kits paths, consistent with DLL sideloading attempts.

Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)

Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.

macOS sysadminctl Used to Add User to Admin Group

Alerts when sysadminctl is used with -addUser and -admin to add a user to the macOS admin group.

macOS dscl Adds User to Admin Group via -append /Groups/admin GroupMembership

Flags dscl commands on macOS that append a user into the local admin group membership.

Windows PowerShell File Dropper Activity: Creating Executables or Script Files

Alerts when PowerShell writes .exe/.dll or script-like files, consistent with binary/script staging or dropping.

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

Alerts on svchost.exe launching rundll32.exe to run davclnt.dll DavSetCookie for WebDav over a non-local IP.