Anvilogic high experimental spl
3CXDesktopApp.exe Execution [splunk-edr]
Malicious activity has been detected on March 29, 2023, originating from a legitimate and signed binary called 3CXDesktopApp, which is a softphone application from 3CX. This malicious activity includes beaconing to infrastructure controlled by the attackers, deployment of additional payloads in the second stage, and in a few cases, direct interaction by the attackers with the system. - Campaign: SmoothOperator - Threat Actor Association: Lazarus Group (aka Labyrinth Chollima)
Detection Logic
`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc"))
OR (TERM(ProcessRollup2)
OR Type=Process)
OR TERM(DeviceProcessEvents)) ("3CXDesktopApp.exe")
OR TERM(3CX Desktop App)
| table _time, host, user signature_id, process, process_*, parent_*
| bin span=1s
| stats values(*) as * by _time, host `hec_collect`Field Validations
Loading…
Comments (0)
Loading comments...