Potential Compromised 3CXDesktopApp Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•19

Detects the execution of known compromised versions of the 3CXDesktopApp by matching specific file hashes (SHA256, SHA1, MD5) or by identifying the executable name, original filename, and product name, potentially combined with a specific file version. This rule aims to identify instances of the supply chain attack that affected 3CXDesktopApp.