From 0ebe65532d970355dc9d3686e4c489bb3f2137bc Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 31 Mar 2023 13:12:23 +0200 Subject: [PATCH] more_3cx --- .../endpoint/non_chrome_process_accessing_chrome_default_dir.yml | 1 + .../endpoint/non_firefox_process_access_firefox_profile_dir.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 989bc63449..631d1fcc12 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -30,6 +30,7 @@ tags: - FIN7 - Remcos - AgentTesla + - 3CX Supply Chain Attack confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 02678b1579..a65d2c16ca 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -31,6 +31,7 @@ tags: - Remcos - Azorult - AgentTesla + - 3CX Supply Chain Attack confidence: 70 context: - Source:Endpoint