XQL Query: Hunting Supply Chain Attack for 3CX

[KanwarSingh01]

This is more from how people are hunting with different EDR tools, so just throwing out something with XQL to the community which might be helpful for us all:

Note: All of the below queries are created from an environment which does not uses 3CX so correct where possible guys.

Query 1: Monitor general Public IP address communication form 3CX Desktop App to Internet: (Gotcha: Don't exclude your Proxy IP from Private IP filter list)

config case_sensitive = false 
| preset = network_story 
| filter actor_process_image_name = "3cxdesktopapp.exe" or actor_process_image_name contains "3cx desktop app"
| filter action_remote_ip != null
| filter incidr(action_remote_ip,"127.0.0.0/8") = false
| filter incidr(action_remote_ip,"10.0.0.0/8") = false 
| filter incidr(action_remote_ip,"192.168.0.0/16") = false 
| filter incidr(action_remote_ip,"172.16.0.0/12") = false
| filter incidr(action_remote_ip,"169.254.0.0/16") = false
| filter incidr(action_remote_ip,"224.0.0.0/4") = false 
| filter incidr(action_remote_ip,"255.255.255.255/32") = false
| iploc action_remote_ip loc_asn, loc_asn_org, loc_country, loc_city, loc_region 
| fields agent_hostname as Host, action_local_ip, action_remote_ip, action_remote_port, loc_asn, loc_asn_org, loc_country, loc_city, loc_region, actor_process_image_name as Process, actor_process_os_pid as PID, actor_process_command_line as Command, actor_process_image_path as Path, actor_process_signature_status as SignerStatus, actor_process_signature_vendor as Vendor, causality_actor_process_image_name as CGO
| sort desc _time 

Query 2: Hunt Suspicious Domains According to Threat Intel Reports

config case_sensitive = false 
| preset = network_story 
| filter dst_action_external_hostname in ("akamaicontainer.com","akamaitechcloudservices.com","azuredeploystore.com","azureonlinecloud.com","azureonlinestorage.com","dunamistrd.com","glcloudservice.com","journalide.org","msedgepackageinfo.com","msstorageazure.com","msstorageboxes.com","officeaddons.com","officestoragebox.com","pbxcloudeservices.com","pbxphonenetwork.com","pbxsources.com","qwepoi123098.com","sbmsa.wiki","sourceslabs.com","visualstudiofactory.com","zacharryblogs.com")
| fields agent_hostname as Host, action_local_ip, action_remote_ip, action_remote_port, dst_action_external_hostname as Domain_Name, actor_process_image_name as Process, actor_process_os_pid as PID, actor_process_command_line as Command, actor_process_image_path as Path, actor_process_signature_status as SignerStatus, actor_process_signature_vendor as Vendor, causality_actor_process_image_name as CGO
| sort desc _time 

Query 3: Find if 3CX Desktop Process Ran in the Environment where Host Inventory is Not available:

config case_sensitive = false 
| preset = xdr_process 
| filter action_process_image_name in ("3cxdesktopapp.exe", "*3cx desktop app*") //Probably last one is for MacOS "not sure about that as we do not use it so please correct if it is incorrect"
| fields agent_hostname as Host, agent_ip_addresses as IP_Addr, action_process_image_name as Process, action_process_image_command_line as Command, action_process_image_sha256 as SHA_256, action_process_os_pid as PID, action_process_signature_status as SignerStatus, action_process_signature_vendor as Vendor, actor_process_image_name as Parent_Process, actor_process_os_pid as Parent_PID, actor_process_command_line as Parent_Command, actor_process_image_path as Parent_Path, causality_actor_process_image_name as CGO
| sort desc _time 

There are other ways of hunting as well but using above you should be able to look out for something suspicious related to this supply chain attack.

Simple Hunts such as Hash etc can also be conducted but since the scale of compromise is not known i personally have no idea if the hash check will do the complete job but that does not mean we should not do hunts based on hash values of the file.

Regards

Kanwar

[mavraham]

@KanwarSingh01 Thank you for sharing with the community!

I'm sure many users will find this useful. 

[afurze]

Hi KanwarSing01,

Thanks for putting this together!  It's worth noting that Cortex XDR blocked this attack out-of-the-box with our In-process Shellcode Protection Module.  Check out this write up by Unit 42.

[KanwarSingh01]

Thanks for the article, after reading the in depth article by Unit 42 i am sure people can create quite a few hunts from it. I am also certain some of the XDR customers must have taken 3CX advice and made an exception for the prevention alert. But who knows.

Thank you.

[dmilrad · Accepted solution]

Thanks for posting these queries.  For more details, IOCs, and other product mitigations the Unit 42 Threat Brief is being updated as we find more information.  https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/

[RFeyertag]

Hey Kanwar!

Thank you for this nice overview! 

To extend the scope for the query 2 my expierience in cortex xdr was:

1. take the dns_query_name field too into your scope with or: 

dst_action_external_hostname in ("*mega.io*","*mega.nz*","*anonfiles.com*","*dropmefiles.com*","*file.io*","*quaz.im*","*temp.sh*","*termbin.com*","*transfer.sh*","*ufile.io*","*wasabisys.com*")
or dns_query_name in ("*mega.io*","*mega.nz*","*anonfiles.com*","*dropmefiles.com*","*file.io*","*quaz.im*","*temp.sh*","*termbin.com*","*transfer.sh*","*ufile.io*","*wasabisys.com*")

2. For subdomains take the star into your scope of the domain to sniff them all:

*wasabisys.com*

BR

Rob