Potential Compromised 3CXDesktopApp Update Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software. This rule specifically looks for the 'update.exe' process within the 3CXDesktopApp directory being executed with command-line arguments indicating an update operation for version '18.12' via HTTP, which was associated with the supply chain compromise.