Malicious DLL Load by Compromised 3CXDesktopApp

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•22

Detects the loading of specific malicious DLLs (ffmpeg.dll, d3dcompiler_47.dll, and an ICONIC Stealer payload) that were identified as compromised and used in attacks involving the 3CXDesktopApp. This rule uses SHA256, SHA1, and MD5 hashes to identify the malicious DLLs.