3CX Supply Chain Attack Networ

Description:

The following analytic identifies DNS queries to domains associated with the 3CX supply chain attack. It leverages the Network_Resolution datamodel to detect these suspicious domain indicators. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.

** Type: TTP

** Product: Splunk Enterprise, Splunk

** Datamodel: Network_Resolution

** Lastupdated: 2024-05-21

** Author: Michael Haag, Splunk

** ID: 791b727c-deec-4fbe-a732-756131