3CX Customers suffering intrusions

[https://www.3cx.com/community/threads/threat-alerts-from-sentinelone-for-desktop-update-initiated-from-desktop-client.119806/page-2](https://www.3cx.com/community/threads/threat-alerts-from-sentinelone-for-desktop-update-initiated-from-desktop-client.119806/page-2)

Sigma:

[https://github.com/SigmaHQ/sigma/pull/4151/files](https://github.com/SigmaHQ/sigma/pull/4151/files)

Yara:

[https://github.com/Neo23x0/signature-base/blob/master/yara/gen\_mal\_3cx\_compromise\_mar23.yar](https://github.com/Neo23x0/signature-base/blob/master/yara/gen_mal_3cx_compromise_mar23.yar)

source:[https://twitter.com/cyb3rops/status/1641130326830333984?s=20](https://twitter.com/cyb3rops/status/1641130326830333984?s=20)

*Atomic Indicators*

The following domains have been observed beaconing which should be considered an indication of malicious intent.

akamaicontainer[.]com
akamaitechcloudservices[.]com
azuredeploystore[.]com
azureonlinecloud[.]com
azureonlinestorage[.]com
dunamistrd[.]com
glcloudservice[.]com
journalide[.]org
msedgepackageinfo[.]com
msstorageazure[.]com
msstorageboxes[.]com
officeaddons[.]com
officestoragebox[.]com
pbxcloudeservices[.]com
pbxphonenetwork[.]com
pbxsources[.]com
qwepoi123098[.]com
sbmsa[.]wiki
sourceslabs[.]com
visualstudiofactory[.]com
zacharryblogs[.]com

source: [https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329\_situational\_awareness\_crowdstrike/](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/)

3cx blueteamsec customers domains intent malicious org sigma wiki yara