Anvilogic high experimental spl
3CXDesktopApp.exe Execution [splunk-sysmon]
Malicious activity has been detected on March 29, 2023, originating from a legitimate and signed binary called 3CXDesktopApp, which is a softphone application from 3CX. This malicious activity includes beaconing to infrastructure controlled by the attackers, deployment of additional payloads in the second stage, and in a few cases, direct interaction by the attackers with the system. - Campaign: SmoothOperator - Threat Actor Association: Lazarus Group (aka Labyrinth Chollima)
Detection Logic
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1)
OR "<EventID>1<"
OR Type=Process) ("3CXDesktopApp.exe"
OR "3CX Desktop App")
| table _time, host, user process, process_*, signature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...