From 0b0da8a86d2d11d92bf45d12f23e9a627008193c Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 10:31:52 -0600
Subject: [PATCH 01/12] 3cx

---
 .../hunting_3cxdesktopapp_software.yml        | 75 +++++++++++++++++++
 .../windows_vulnerable_3cx_software.yml       | 71 ++++++++++++++++++
 .../3cx_supply_chain_attack_2023_03_29.yml    | 23 ++++++
 .../hunting_3cxdesktopapp_software.test.yml   | 13 ++++
 .../windows_vulnerable_3cx_software.test.yml  | 13 ++++
 5 files changed, 195 insertions(+)
 create mode 100644 detections/endpoint/hunting_3cxdesktopapp_software.yml
 create mode 100644 detections/endpoint/windows_vulnerable_3cx_software.yml
 create mode 100644 stories/3cx_supply_chain_attack_2023_03_29.yml
 create mode 100644 tests/endpoint/hunting_3cxdesktopapp_software.test.yml
 create mode 100644 tests/endpoint/windows_vulnerable_3cx_software.test.yml

diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml
new file mode 100644
index 0000000000..f322f2b468
--- /dev/null
+++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml
@@ -0,0 +1,75 @@
+name: Hunting 3CXDesktopApp Software
+id: 553d0429-1a1c-44bf-b3f5-a8513deb9ee5
+version: 1
+date: '2023-03-30'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The hunting analytic outlined below is designed to detect any version of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac or Windows systems. It is important to note that this particular analytic employs the Endpoint datamodel Processes node, which means that the file version information is not provided. Recently, 3CX has identified a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=3CXDesktopApp.exe OR Processes.process_name="3CX Desktop App"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
+references:
+  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
+  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
+  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
+tags:
+  analytic_story:
+  - 3CX Supply Chain Attack
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Delivery
+  - Installation
+  message: An instance $process_name$ was identified on endpoint $dest$.
+  mitre_attack_id:
+  - T1195.002
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 40
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
new file mode 100644
index 0000000000..b23af8c60f
--- /dev/null
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -0,0 +1,71 @@
+name: Windows Vulnerable 3CX Software
+id: f2cc1584-46ee-485b-b905-977c067f36de
+version: 1
+date: '2023-03-30'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe)  FileVersion=18.12.* 
+  | rename Computer as dest 
+  | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`| `windows_vulnerable_3cx_software_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on file version, modify the analytic to only look for version between 18.12.407 and 18.12.416 as needed.
+references:
+  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
+  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
+  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
+tags:
+  analytic_story:
+  - 3CX Supply Chain Attack
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Delivery
+  - Installation
+  message: A known vulnerable instance of 3CX Software $process_name$ ran on $dest$, related to a supply chain attack.
+  mitre_attack_id:
+  - T1195.002
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OriginalFileName
+  - process_name
+  - EventID
+  - CommandLine
+  - Computer
+  - parent_process_name
+  risk_score: 80
+  security_domain: endpoint
\ No newline at end of file
diff --git a/stories/3cx_supply_chain_attack_2023_03_29.yml b/stories/3cx_supply_chain_attack_2023_03_29.yml
new file mode 100644
index 0000000000..767f4318fa
--- /dev/null
+++ b/stories/3cx_supply_chain_attack_2023_03_29.yml
@@ -0,0 +1,23 @@
+name: 3CX Supply Chain Attack
+id: c4d7618c-73a7-4f7c-8071-060c36850785
+version: 1
+date: '2023-03-30'
+author: Michael Haag, Splunk
+description: On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp — a softphone application from 3CX. The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. (CrowdStrike)
+narrative: On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.
+references:
+  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
+  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
+  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
+  - https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack
+tags:
+  analytic_story: 3CX Supply Chain Attack
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
diff --git a/tests/endpoint/hunting_3cxdesktopapp_software.test.yml b/tests/endpoint/hunting_3cxdesktopapp_software.test.yml
new file mode 100644
index 0000000000..594966f003
--- /dev/null
+++ b/tests/endpoint/hunting_3cxdesktopapp_software.test.yml
@@ -0,0 +1,13 @@
+name: Hunting 3CXDesktopApp Software Unit Test
+tests:
+- name: Hunting 3CXDesktopApp Software
+  file: endpoint/hunting_3cxdesktopapp_software.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 3cx_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_vulnerable_3cx_software.test.yml b/tests/endpoint/windows_vulnerable_3cx_software.test.yml
new file mode 100644
index 0000000000..eeaff5e8d0
--- /dev/null
+++ b/tests/endpoint/windows_vulnerable_3cx_software.test.yml
@@ -0,0 +1,13 @@
+name: Windows Vulnerable 3CX Software Unit Test
+tests:
+- name: Windows Vulnerable 3CX Software
+  file: endpoint/windows_vulnerable_3cx_software.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 3cx_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 48e5339bea40a4237fa0ae2ee2648e029ec9203b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 10:36:14 -0600
Subject: [PATCH 02/12] oops

---
 ...ly_chain_attack_2023_03_29.yml => 3cx_supply_chain_attack.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename stories/{3cx_supply_chain_attack_2023_03_29.yml => 3cx_supply_chain_attack.yml} (100%)

diff --git a/stories/3cx_supply_chain_attack_2023_03_29.yml b/stories/3cx_supply_chain_attack.yml
similarity index 100%
rename from stories/3cx_supply_chain_attack_2023_03_29.yml
rename to stories/3cx_supply_chain_attack.yml

From 63136279fe29bb41a8ff6d9038815d1102a00bde Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 10:40:22 -0600
Subject: [PATCH 03/12] fix?

---
 stories/3cx_supply_chain_attack.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml
index 767f4318fa..c919aaafe3 100644
--- a/stories/3cx_supply_chain_attack.yml
+++ b/stories/3cx_supply_chain_attack.yml
@@ -3,8 +3,8 @@ id: c4d7618c-73a7-4f7c-8071-060c36850785
 version: 1
 date: '2023-03-30'
 author: Michael Haag, Splunk
-description: On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp — a softphone application from 3CX. The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. (CrowdStrike)
-narrative: On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.
+description: 'On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp — a softphone application from 3CX. The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. (CrowdStrike)'
+narrative: 'On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.'
 references:
   - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
   - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp

From ec4593bb5cdb5f4e55fbc8db5f64e479b285e21f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 10:43:37 -0600
Subject: [PATCH 04/12] Update 3cx_supply_chain_attack.yml

---
 stories/3cx_supply_chain_attack.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml
index c919aaafe3..0797e4569d 100644
--- a/stories/3cx_supply_chain_attack.yml
+++ b/stories/3cx_supply_chain_attack.yml
@@ -3,7 +3,7 @@ id: c4d7618c-73a7-4f7c-8071-060c36850785
 version: 1
 date: '2023-03-30'
 author: Michael Haag, Splunk
-description: 'On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp — a softphone application from 3CX. The malicious activity includes beaconing to actor-controlled infrastructure, deployment of second-stage payloads, and, in a small number of cases, hands-on-keyboard activity. (CrowdStrike)'
+description: 'On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp,  a softphone application from 3CX. The malicious activity includes beaconing to actor controlled infrastructure, deployment of second stage payloads, and, in a small number of cases, hands on keyboard activity. (CrowdStrike)'
 narrative: 'On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.'
 references:
   - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/

From a8d2c241468b95585250ce6f112fa9db3c83d016 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 10:45:56 -0600
Subject: [PATCH 05/12] Update windows_vulnerable_3cx_software.yml

---
 detections/endpoint/windows_vulnerable_3cx_software.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
index b23af8c60f..f9fc459878 100644
--- a/detections/endpoint/windows_vulnerable_3cx_software.yml
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -67,5 +67,5 @@ tags:
   - CommandLine
   - Computer
   - parent_process_name
-  risk_score: 80
+  risk_score: 90
   security_domain: endpoint
\ No newline at end of file

From 673c1bce72fa871b0aaf39856c5ab14814b0ded8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 11:09:41 -0600
Subject: [PATCH 06/12] Update 3cx_supply_chain_attack.yml

---
 stories/3cx_supply_chain_attack.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml
index 0797e4569d..537d3880ef 100644
--- a/stories/3cx_supply_chain_attack.yml
+++ b/stories/3cx_supply_chain_attack.yml
@@ -12,6 +12,7 @@ references:
   - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
   - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
   - https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack
+  - https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/
 tags:
   analytic_story: 3CX Supply Chain Attack
   category:

From ce595f6eef447d47d699d8fec13a3529957730c6 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 11:12:52 -0600
Subject: [PATCH 07/12] fixes

---
 detections/endpoint/hunting_3cxdesktopapp_software.yml  | 2 +-
 detections/endpoint/windows_vulnerable_3cx_software.yml | 2 +-
 tests/endpoint/hunting_3cxdesktopapp_software.test.yml  | 2 +-
 tests/endpoint/windows_vulnerable_3cx_software.test.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/hunting_3cxdesktopapp_software.yml b/detections/endpoint/hunting_3cxdesktopapp_software.yml
index f322f2b468..c62351c051 100644
--- a/detections/endpoint/hunting_3cxdesktopapp_software.yml
+++ b/detections/endpoint/hunting_3cxdesktopapp_software.yml
@@ -35,7 +35,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log
   impact: 80
   kill_chain_phases:
   - Delivery
diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
index f9fc459878..0e2ce4cfd1 100644
--- a/detections/endpoint/windows_vulnerable_3cx_software.yml
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -36,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log
   impact: 100
   kill_chain_phases:
   - Delivery
diff --git a/tests/endpoint/hunting_3cxdesktopapp_software.test.yml b/tests/endpoint/hunting_3cxdesktopapp_software.test.yml
index 594966f003..b1b45e6873 100644
--- a/tests/endpoint/hunting_3cxdesktopapp_software.test.yml
+++ b/tests/endpoint/hunting_3cxdesktopapp_software.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   attack_data:
   - file_name: 3cx_windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: true
diff --git a/tests/endpoint/windows_vulnerable_3cx_software.test.yml b/tests/endpoint/windows_vulnerable_3cx_software.test.yml
index eeaff5e8d0..557195e13f 100644
--- a/tests/endpoint/windows_vulnerable_3cx_software.test.yml
+++ b/tests/endpoint/windows_vulnerable_3cx_software.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   attack_data:
   - file_name: 3cx_windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/1195.002/3CX/3cx_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
     update_timestamp: true

From 89dff5cb653a5ce095ee228ed1ff93ab3236159e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 12:15:41 -0600
Subject: [PATCH 08/12] dns

---
 ...supply_chain_attack_network_indicators.yml | 60 +++++++++++++++++++
 lookups/3cx_ioc_domains.csv                   | 39 ++++++++++++
 lookups/3cx_ioc_domains.yml                   |  7 +++
 ...y_chain_attack_network_indicators.test.yml | 13 ++++
 4 files changed, 119 insertions(+)
 create mode 100644 detections/network/3cx_supply_chain_attack_network_indicators.yml
 create mode 100644 lookups/3cx_ioc_domains.csv
 create mode 100644 lookups/3cx_ioc_domains.yml
 create mode 100644 tests/network/3cx_supply_chain_attack_network_indicators.test.yml

diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml
new file mode 100644
index 0000000000..2c73369123
--- /dev/null
+++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml
@@ -0,0 +1,60 @@
+name: 3CX Supply Chain Attack Network Indicators
+id: 791b727c-deec-4fbe-a732-756131b3c5a1
+version: 1
+date: '2023-03-30'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Network_Resolution
+description: The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises.
+search: '| tstats `summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query 
+  | `drop_dm_object_name(DNS)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC
+  | search isIOC=true
+  | `3cx_supply_chain_attack_network_indicators_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed.
+known_false_positives: False positives will be present for accessing the 3cx[.]com website. Remove from the lookup as needed.
+references:
+  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
+  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
+  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
+tags:
+  analytic_story:
+  - 3CX Supply Chain Attack
+  asset_type: Network
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Scope:Network
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Command & Control
+  message: Indicators related to 3CX supply chain attack have been identified on $src$.
+  mitre_attack_id:
+  - T1195.002
+  nist:
+  - DE.CM
+  observable:
+  - name: src
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - DNS.src
+  - DNS.query 
+  - _time
+  risk_score: UPDATE (impact * confidence)/100
+  security_domain: network
\ No newline at end of file
diff --git a/lookups/3cx_ioc_domains.csv b/lookups/3cx_ioc_domains.csv
new file mode 100644
index 0000000000..ed1a5ec157
--- /dev/null
+++ b/lookups/3cx_ioc_domains.csv
@@ -0,0 +1,39 @@
+domain,isIOC,Description
+akamaicontainer.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+akamaitechcloudservices.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azuredeploystore.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azureonlinecloud.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azureonlinestorage.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+dunamistrd.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+glcloudservice.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+journalide.org,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msedgepackageinfo.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msstorageazure.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msstorageboxes.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+officeaddons.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+officestoragebox.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxcloudeservices.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxphonenetwork.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxsources.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+qwepoi123098.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+sbmsa.wiki,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+sourceslabs.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+visualstudiofactory.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+zacharryblogs.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+www.3cx.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+akamaitechcloudservices.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+azureonlinestorage.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msedgepackageinfo.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+glcloudservice.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxsources.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msstorageazure.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+officestoragebox.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+visualstudiofactory.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+azuredeploystore.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msstorageboxes.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+officeaddons.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+sourceslabs.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+zacharryblogs.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxcloudeservices.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxphonenetwork.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msedgeupdate.net,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
\ No newline at end of file
diff --git a/lookups/3cx_ioc_domains.yml b/lookups/3cx_ioc_domains.yml
new file mode 100644
index 0000000000..611c4c7f7d
--- /dev/null
+++ b/lookups/3cx_ioc_domains.yml
@@ -0,0 +1,7 @@
+description: A list of domains from the 3CX supply chain attack.
+filename: 3cx_ioc_domains.csv
+name: 3cx_ioc_domains
+default_match: 'false'
+match_type: WILDCARD(domain)
+min_matches: 1
+case_sensitive_match: 'false'
\ No newline at end of file
diff --git a/tests/network/3cx_supply_chain_attack_network_indicators.test.yml b/tests/network/3cx_supply_chain_attack_network_indicators.test.yml
new file mode 100644
index 0000000000..40a5211153
--- /dev/null
+++ b/tests/network/3cx_supply_chain_attack_network_indicators.test.yml
@@ -0,0 +1,13 @@
+name: 3CX Supply Chain Attack Network Indicators Unit Test
+tests:
+- name: 3CX Supply Chain Attack Network Indicators
+  file: network/3cx_supply_chain_attack_network_indicators.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: 3cx_network-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 57178903ca1354bb51b90cf7e5538b4dcadf0524 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 12:21:48 -0600
Subject: [PATCH 09/12] Update windows_vulnerable_3cx_software.yml

---
 detections/endpoint/windows_vulnerable_3cx_software.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
index 0e2ce4cfd1..efea7e4664 100644
--- a/detections/endpoint/windows_vulnerable_3cx_software.yml
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2023-03-30'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
 search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe)  FileVersion=18.12.* 
   | rename Computer as dest 
@@ -68,4 +67,4 @@ tags:
   - Computer
   - parent_process_name
   risk_score: 90
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint

From e61f2708cb670b4ebb4ae3650e6150a3652dc8f8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 12:30:04 -0600
Subject: [PATCH 10/12] Update 3cx_supply_chain_attack_network_indicators.yml

---
 .../network/3cx_supply_chain_attack_network_indicators.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml
index 2c73369123..c21783e5e7 100644
--- a/detections/network/3cx_supply_chain_attack_network_indicators.yml
+++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml
@@ -56,5 +56,5 @@ tags:
   - DNS.src
   - DNS.query 
   - _time
-  risk_score: UPDATE (impact * confidence)/100
+  risk_score: 100
   security_domain: network
\ No newline at end of file

From c973970b81ef74399ea2184181b501ee0d755c82 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 12:48:51 -0600
Subject: [PATCH 11/12] moved to experimental

---
 .../network/3cx_supply_chain_attack_network_indicators.yml        | 0
 .../network/3cx_supply_chain_attack_network_indicators.test.yml   | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename detections/{ => experimental}/network/3cx_supply_chain_attack_network_indicators.yml (100%)
 rename tests/{ => experimental}/network/3cx_supply_chain_attack_network_indicators.test.yml (100%)

diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml
similarity index 100%
rename from detections/network/3cx_supply_chain_attack_network_indicators.yml
rename to detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml
diff --git a/tests/network/3cx_supply_chain_attack_network_indicators.test.yml b/tests/experimental/network/3cx_supply_chain_attack_network_indicators.test.yml
similarity index 100%
rename from tests/network/3cx_supply_chain_attack_network_indicators.test.yml
rename to tests/experimental/network/3cx_supply_chain_attack_network_indicators.test.yml

From 48351c5521c345f87533082998f73b016abba8ad Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 30 Mar 2023 14:42:26 -0500
Subject: [PATCH 12/12] Update 3cx_supply_chain_attack_network_indicators.yml

---
 .../network/3cx_supply_chain_attack_network_indicators.yml  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml b/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml
index c21783e5e7..0003fb7371 100644
--- a/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml
+++ b/detections/experimental/network/3cx_supply_chain_attack_network_indicators.yml
@@ -48,6 +48,10 @@ tags:
     type: Hostname
     role:
     - Victim
+  - name: query
+    type: URL Domain
+    role:
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -57,4 +61,4 @@ tags:
   - DNS.query 
   - _time
   risk_score: 100
-  security_domain: network
\ No newline at end of file
+  security_domain: network