Sigma rule: Potential Compromised 3CXDesktopApp ICO C2 File Download
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-6063ea795a2f, updated 2023-03-31T00:00:00.000Z.
Rule
- Title
- Potential Compromised 3CXDesktopApp ICO C2 File Download
- Status
- test
- Level
- high
- Author
- Nasreddine Bencherchali (Nextron Systems)
- Date
- 2023-03-31
- File
- rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository
Log source
- category
- proxy
Detection
selection:
c-uri|contains|all:
- 'IconStorages/images/main/icon'
- '.ico'
condition: selectionFalse positives (as the rule lists them)
- Unknown
Tags
- attack.command-and-control
- detection.emerging-threats
Related rules
- 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26 (similar)
- bd03a0dc-5d93-49eb-b2e8-2dfd268600f8 (similar)
- 51eecf75-d069-43c7-9ea2-63f75499edd4 (similar)
- 93bbde78-dc86-4e73-9ffc-ff8a384ca89c (similar)
- 63f3605b-979f-48c2-b7cc-7f90523fed88 (similar)
- e7581747-1e44-4d4b-85a6-0db0b4a00f2a (similar)
- d0b65ad3-e945-435e-a7a9-438e62dd48e9 (similar)
References
- https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
- https://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml
Sources and licences
SigmaHQ
"Potential Compromised 3CXDesktopApp ICO C2 File Download" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Potential Compromised 3CXDesktopApp ICO C2 File Download",
entity page, dataset version ref-6063ea795a2f, updated 2023-03-31T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/76bc1601-9546-4b75-9419-06e0e8d10651 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 76bc1601-9546-4b75-9419-06e0e8d10651, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.