3CX Supply Chain Attack Network Indicators
Compromise Software Supply Chain
Network_Resolution
Detect DGA domains using pretrained model in DSDL
Domain Generation Algorithms
Detect suspicious DNS TXT records using pretrained model in DSDL
Domain Generation Algorithms
Excessive DNS Failures
DNS, Application Layer Protocol
Ngrok Reverse Proxy on Network
Protocol Tunneling, Proxy, Web Service
Detection of DNS Tunnels
Exfiltration Over Unencrypted Non-C2 Protocol
DNS Query Length With High Standard Deviation
Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol
Detect hosts connecting to dynamic domain providers
Drive-by Compromise
Detect Windows DNS SIGRed via Zeek
Exploitation for Client Execution
Clients Connecting to Multiple DNS Servers
Exfiltration Over Unencrypted Non-C2 Protocol
Detect DNS requests to Phishing Sites leveraging EvilGinx2
Spearphishing via Service
Detect Long DNS TXT Record Response
Exfiltration Over Unencrypted Non-C2 Protocol
DNS Query Length Outliers - MLTK
DNS, Application Layer Protocol
Large Volume of DNS ANY Queries
Network Denial of Service, Reflection Amplification