False positive 3CXDesktopApp-18.12.425 alert from Threatlocker

[emerald1]

See screenshot attached.

Our Application Whitelisting program has blocked 3CX Desktop App 18.12.425 from calling powershell.exe

Does anyone know why exactly the desktop app is trying to invoke powershell? Is this another intrusion or is there a legitimate reason 3CX should be calling out to attempt to run powershell?

 

[Vali_3CX]

Maybe you configured it to launch a program on an incoming call?

 

[DimitrisL_3CX]

Hello @emerald1 thank you for the report.
I will PM you for further information.

 

[DimitrisL_3CX]

We have replied to you via PM, in the meantime we have also contacted AV vendor.
Once this has been received further updates will be posted here.
Our communication will remain transparent throughout this investigation.

 

[StavrosA_3CX]

We are still waiting for a reply from the vendor. Once received we will update this forum thread.

 

[emerald1]

Maybe you configured it to launch a program on an incoming call?

See screenshot. Nothing configured.

 

[emerald1]

We are still waiting for a reply from the vendor. Once received we will update this forum thread.

Stavros,

What information are you wanting from the vendor about this? Their product and their team confirmed that 3CX had attempted to call powershell.

 

[TheodorosG_3CX]

Hello @emerald1 , we have also contacted with the vendor but yet we have not received any update.
What is the analysis that has been provided to you on this case?

 

[emerald1]

The vendor is not an EDR/AV company. They are an application whitelisting program called Threatlocker.

The 3CX desktop app attempted to call Powershell.exe and was blocked by the whitelisting program.

Why would 3CX try to call powershell.exe? Thank you for all the help on this!

 

[TheodorosG_3CX]

What was the response that you have received from Threatlocker?
What was the analysis from their side?
What is the ticket number that you have with Threatlocker?

 

[TheodorosG_3CX]

We are marking this alert as False Positive, as we have not received any confirmation from the Vendor.