Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.62.0"
+      "version": "3.63.0"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4587,6 +4587,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = admin or user tool that can terminate multiple process.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Hunting 3CXDesktopApp Software - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The hunting analytic outlined below is designed to detect any version of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac or Windows systems. It is important to note that this particular analytic employs the Endpoint datamodel Processes node, which means that the file version information is not provided. Recently, 3CX has identified a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+known_false_positives = There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Hunting for Log4Shell - Rule]
 type = detection
 asset_type = Web Server
@@ -10553,6 +10563,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Vulnerable 3CX Software - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on file version, modify the analytic to only look for version between 18.12.407 and 18.12.416 as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows WMI Impersonate Token - Rule]
 type = detection
 asset_type = Endpoint
@@ -11829,6 +11849,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.
 providing_technologies = null
 
+[savedsearch://ESCU - 3CX Supply Chain Attack Network Indicators - Rule]
+type = detection
+asset_type = Network
+confidence = medium
+explanation = The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises.
+how_to_implement = To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present for accessing the 3cx[.]com website. Remove from the lookup as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Detect ARP Poisoning - Rule]
 type = detection
 asset_type = Infrastructure
@@ -12459,6 +12489,17 @@ providing_technologies = null
 
 ### STORIES ###
 
+[analytic_story://3CX Supply Chain Attack]
+category = Adversary Tactics
+last_updated = 2023-03-30
+version = 1
+references = ["https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/", "https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp", "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/", "https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898", "https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/", "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack", "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Hunting 3CXDesktopApp Software - Rule", "ESCU - Windows Vulnerable 3CX Software - Rule", "ESCU - 3CX Supply Chain Attack Network Indicators - Rule"]
+description = On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp,  a softphone application from 3CX. The malicious activity includes beaconing to actor controlled infrastructure, deployment of second stage payloads, and, in a small number of cases, hands on keyboard activity. (CrowdStrike)
+narrative = On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.
+
 [analytic_story://IcedID]
 category = Malware
 last_updated = 2021-07-29

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 12515
+build = 12686
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.62.0
+version = 3.63.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.62.0
+version = 3.63.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1805,6 +1805,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[hunting_3cxdesktopapp_software_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [hunting_for_log4shell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4141,6 +4145,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_vulnerable_3cx_software_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_impersonate_token_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4629,6 +4637,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[3cx_supply_chain_attack_network_indicators_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_arp_poisoning_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -515,7 +515,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*" AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info, Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_improperly_formatted_parameter_crashes_splunkd_filter`
 
 [ESCU - Persistent XSS in RapidDiag through User Interface Views - Rule]
 action.escu = 0
@@ -19725,6 +19725,46 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated min(_time) as firstTime max(_time) as lastTime  count by _time Computer EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`
 
+[ESCU - Hunting 3CXDesktopApp Software - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The hunting analytic outlined below is designed to detect any version of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac or Windows systems. It is important to note that this particular analytic employs the Endpoint datamodel Processes node, which means that the file version information is not provided. Recently, 3CX has identified a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The hunting analytic outlined below is designed to detect any version of the 3CXDesktopApp, also known as the 3CX Desktop App, operating on either Mac or Windows systems. It is important to note that this particular analytic employs the Endpoint datamodel Processes node, which means that the file version information is not provided. Recently, 3CX has identified a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = There may be false positives generated due to the reliance on version numbers for identification purposes. Despite this limitation, the primary goal of this approach is to aid in the detection of the software within the environment.
+action.escu.creation_date = 2023-03-30
+action.escu.modification_date = 2023-03-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Hunting 3CXDesktopApp Software - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["3CX Supply Chain Attack"]
+action.risk = 1
+action.risk.param._risk_message = An instance $process_name$ was identified on endpoint $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Hunting 3CXDesktopApp Software - Rule
+action.correlationsearch.annotations = {"analytic_story": ["3CX Supply Chain Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=3CXDesktopApp.exe OR Processes.process_name="3CX Desktop App" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `hunting_3cxdesktopapp_software_filter`
+
 [ESCU - Hunting for Log4Shell - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -45381,6 +45421,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`
 
+[ESCU - Windows Vulnerable 3CX Software - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = False positives may be present based on file version, modify the analytic to only look for version between 18.12.407 and 18.12.416 as needed.
+action.escu.creation_date = 2023-03-30
+action.escu.modification_date = 2023-03-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Vulnerable 3CX Software - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["3CX Supply Chain Attack"]
+action.risk = 1
+action.risk.param._risk_message = A known vulnerable instance of 3CX Software $process_name$ ran on $dest$, related to a supply chain attack.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Vulnerable 3CX Software - Rule
+action.correlationsearch.annotations = {"analytic_story": ["3CX Supply Chain Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Delivery", "Installation"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
+action.notable.param.rule_title = Windows Vulnerable 3CX Software
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe)  FileVersion=18.12.* | rename Computer as dest | stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name,process_name, OriginalFileName, CommandLine | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_vulnerable_3cx_software_filter`
+
 [ESCU - Windows WMI Impersonate Token - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -50716,6 +50802,52 @@ realtime_schedule = 0
 is_visible = false
 search = `wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?<query>[^;|^$]+)" | search query!="SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'" AND query!="SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, query  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmi_temporary_event_subscription_filter`
 
+[ESCU - 3CX Supply Chain Attack Network Indicators - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Network_Resolution"]
+action.escu.eli5 = The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed.
+action.escu.known_false_positives = False positives will be present for accessing the 3cx[.]com website. Remove from the lookup as needed.
+action.escu.creation_date = 2023-03-30
+action.escu.modification_date = 2023-03-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - 3CX Supply Chain Attack Network Indicators - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["3CX Supply Chain Attack"]
+action.risk = 1
+action.risk.param._risk_message = Indicators related to 3CX supply chain attack have been identified on $src$.
+action.risk.param._risk = [{"risk_object_field": "src", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "query", "threat_object_type": "url domain"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - 3CX Supply Chain Attack Network Indicators - Rule
+action.correlationsearch.annotations = {"analytic_story": ["3CX Supply Chain Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Scope:Network"], "impact": 100, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1195.002"], "nist": ["DE.CM"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The analytic provided below employs the Network_Resolution datamodel to detect domain indicators associated with the 3CX supply chain attack. By leveraging this query, you can efficiently conduct retrospective analysis of your data to uncover potential compromises.
+action.notable.param.rule_title = 3CX Supply Chain Attack Network Indicators
+action.notable.param.security_domain = network
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter`
+
 [ESCU - Detect ARP Poisoning - Rule]
 action.escu = 0
 action.escu.enabled = 1

dist/escu/default/transforms.conf

@@ -1,10 +1,18 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
+[3cx_ioc_domains]
+filename = 3cx_ioc_domains.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of domains from the 3CX supply chain attack.
+match_type = WILDCARD(domain)
+min_matches = 1
+
 [__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl]
 filename = __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
 case_sensitive_match = false

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-03-21T21:34:09 UTC
+# On Date: 2023-03-30T20:08:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/3cx_ioc_domains.csv

@@ -0,0 +1,39 @@
+domain,isIOC,Description
+akamaicontainer.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+akamaitechcloudservices.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azuredeploystore.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azureonlinecloud.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+azureonlinestorage.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+dunamistrd.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+glcloudservice.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+journalide.org,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msedgepackageinfo.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msstorageazure.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+msstorageboxes.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+officeaddons.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+officestoragebox.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxcloudeservices.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxphonenetwork.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+pbxsources.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+qwepoi123098.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+sbmsa.wiki,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+sourceslabs.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+visualstudiofactory.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+zacharryblogs.com,TRUE,https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
+www.3cx.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+akamaitechcloudservices.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+azureonlinestorage.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msedgepackageinfo.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+glcloudservice.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxsources.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msstorageazure.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+officestoragebox.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+visualstudiofactory.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+azuredeploystore.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msstorageboxes.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+officeaddons.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+sourceslabs.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+zacharryblogs.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxcloudeservices.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+pbxphonenetwork.com,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
+msedgeupdate.net,TRUE,https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/

docs/mitre-map/coverage.json

@@ -236,8 +236,8 @@
         },
         {
             "techniqueID": "T1195.002",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/github_actions_disable_security_workflow.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/github_actions_disable_security_workflow.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_3cxdesktopapp_software.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_vulnerable_3cx_software.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/3cx_supply_chain_attack_network_indicators.yml"
         },
         {
             "techniqueID": "T1195",