Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 15 subscribers
  • Views 3720 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

3CX users under DLL-sideloading attack

FrasianX0

Trying to run the latest 3CX; however receiving this error: finished - errors - no such table: xdr_data

SELECT

  meta_hostname,

  sophos_pids,

  domain,

  clean_urls,

  source_ips,

  destination_ips,

  timestamps,

  ingestion_timestamp

FROM

  xdr_data

WHERE

  query_name = 'sophos_urls_windows'

  AND

    (LOWER(domain) = 'akamaicontainer.com'

    OR LOWER(domain) = 'akamaitechcloudservices.com'

    OR LOWER(domain) = 'azuredeploystore.com'

    OR LOWER(domain) = 'azureonlinecloud.com'

    OR LOWER(domain) = 'azureonlinestorage.com'

    OR LOWER(domain) = 'dunamistrd.com'

    OR LOWER(domain) = 'glcloudservice.com'

    OR LOWER(domain) = 'journalide.org'

    OR LOWER(domain) = 'msedgepackageinfo.com'

    OR LOWER(domain) = 'msstorageazure.com'

    OR LOWER(domain) = 'msstorageboxes.com'

    OR LOWER(domain) = 'officeaddons.com'

    OR LOWER(domain) = 'officestoragebox.com'

    OR LOWER(domain) = 'pbxcloudeservices.com'

    OR LOWER(domain) = 'pbxphonenetwork.com'

    OR LOWER(domain) = 'pbxsources.com'

    OR LOWER(domain) = 'qwepoi123098.com'

    OR LOWER(domain) = 'sbmsa.wiki'

    OR LOWER(domain) = 'sourceslabs.com'

    OR LOWER(domain) = 'visualstudiofactory.com'

    OR LOWER(domain) = 'zacharryblogs.com'

    OR (LOWER(domain) = 'raw.githubusercontent.com' AND LOWER(clean_urls) LIKE '%/iconstorages/images/main/%'))




This thread was automatically locked due to age.
Parents Reply Children
Unfiltered HTML