Anvilogic high experimental other

3CXDesktopApp.exe Execution [snowflake-crowdstrikefdr_process]

Malicious activity has been detected on March 29, 2023, originating from a legitimate and signed binary called 3CXDesktopApp, which is a softphone application from 3CX. This malicious activity includes beaconing to infrastructure controlled by the attackers, deployment of additional payloads in the second stage, and in a few cases, direct interaction by the attackers with the system. - Campaign: SmoothOperator - Threat Actor Association: Lazarus Group (aka Labyrinth Chollima)

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Win' or event_platform = 'Mac') and (process_path ilike '%3CXDesktopApp.exe' or process_path ilike '%3CX Desktop App%')

Field Validations

Loading…

Comments (0)

Loading comments...