title: Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
id: 51eecf75-d069-43c7-9ea2-63f75499edd4
related:
- id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26 # Proxy C2
type: similar
- id: 76bc1601-9546-4b75-9419-06e0e8d10651 # Proxy GH
type: similar
- id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8 # DNS C2
type: similar
- id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c # ProcCreation Exec
type: similar
- id: 63f3605b-979f-48c2-b7cc-7f90523fed88 # ProcCreation ChildProc
type: similar
- id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a # ProcCreation Update
type: similar
- id: d0b65ad3-e945-435e-a7a9-438e62dd48e9 # ImageLoad
type: similar
status: test
description: Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise
references:
- https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-29
modified: 2023-03-31
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: '\3CXDesktopApp.exe'
DestinationHostname|contains:
- 'akamaicontainer.com'
- 'akamaitechcloudservices.com'
- 'azuredeploystore.com'
- 'azureonlinecloud.com'
- 'azureonlinestorage.com'
- 'dunamistrd.com'
- 'glcloudservice.com'
- 'journalide.org'
- 'msedgepackageinfo.com'
- 'msstorageazure.com'
- 'msstorageboxes.com'
- 'officeaddons.com'
- 'officestoragebox.com'
- 'pbxcloudeservices.com'
- 'pbxphonenetwork.com'
- 'pbxsources.com'
- 'qwepoi123098.com'
- 'sbmsa.wiki'
- 'sourceslabs.com'
- 'visualstudiofactory.com'
- 'zacharryblogs.com'
condition: selection
falsepositives:
- Unlikely
level: high