Sigma high test sigma

Potential Suspicious Child Process Of 3CXDesktopApp

Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

View Source

Detection Logic

{
  "selection": {
    "ParentImage
| endswith": "\\3CXDesktopApp.exe",
    "Image
| endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...