Potential Suspicious Child Process Of 3CXDesktopApp

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

Detects potential suspicious child processes spawned by '3CXDesktopApp.exe', which could indicate compromise related to the 3CXDesktopApp supply chain attack. Specifically, it looks for the 3CXDesktopApp spawning common system binaries often abused for execution, command and control, or defense evasion.