Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

  QueryName

'akamaicontainer.com'

'akamaitechcloudservices.com'

'azuredeploystore.com'

'azureonlinecloud.com'

'azureonlinestorage.com'

'dunamistrd.com'

'glcloudservice.com'

'journalide.org'

'msedgepackageinfo.com'

'msedgeupdate.net'

'msstorageazure.com'

'msstorageboxes.com'

'officeaddons.com'

'officestoragebox.com'

'pbxcloudeservices.com'

'pbxphonenetwork.com'

'pbxsources.com'

'qwepoi123098.com'

'sbmsa.wiki'

'sourceslabs.com'

'visualstudiofactory.com'

'zacharryblogs.com'

Detection Query 1

(resourceName = "Sysmon"  AND eventtype = "22"  ) AND queryname In ("akamaicontainer.com" , "akamaitechcloudservices.com" , "azuredeploystore.com" , "azureonlinecloud.com" , "azureonlinestorage.com" , "dunamistrd.com" , "glcloudservice.com" , "journalide.org" , "msedgepackageinfo.com" , "msedgeupdate.net" , "msstorageazure.com" , "msstorageboxes.com" , "officeaddons.com" , "officestoragebox.com" , "pbxcloudeservices.com" , "pbxphonenetwork.com" , "pbxsources.com" , "qwepoi123098.com" , "sbmsa.wiki" , "sourceslabs.com" , "visualstudiofactory.com" , "zacharryblogs.com" )

Detection Query 2

(technologygroup = "EDR"   ) AND queryname In ("akamaicontainer.com" , "akamaitechcloudservices.com" , "azuredeploystore.com" , "azureonlinecloud.com" , "azureonlinestorage.com" , "dunamistrd.com" , "glcloudservice.com" , "journalide.org" , "msedgepackageinfo.com" , "msedgeupdate.net" , "msstorageazure.com" , "msstorageboxes.com" , "officeaddons.com" , "officestoragebox.com" , "pbxcloudeservices.com" , "pbxphonenetwork.com" , "pbxsources.com" , "qwepoi123098.com" , "sbmsa.wiki" , "sourceslabs.com" , "visualstudiofactory.com" , "zacharryblogs.com")