False positive EDR System Alert

[Rafael Diniz]

Good afternoon,

A customer's EDR system is generating "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=pt-BR --service-sandbox-type=none --ignore-certificate-errors=true --ignore-certificate-errors=true --user-data-dir="C:\Users\paulo\AppData\Roaming\3CXDesktopApp" --standard-schemes=voipc --enable-sandbox --secure-schemes=voipc --bypasscsp-schemes --cors-schemes=voipc --fetch-schemes=voipc --service-worker-schemes=voipc --streaming-schemes --mojo-platform-channel-handle=1876 --field-trial-handle=1708,i,1235868302395507347,9706067012765610875,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8" alerts, I would like to know if this is normal or something that needs to be investigated?

Grateful.

 

[Charles_3CX]

Regarding your question, can you please let us know the version of the desktop app you are running?

You can get the version by right-clicking the desktop app icon from the taskbar tray and about.

Additionally, Which version is the 3CX system exactly please and what build number..

We take security very seriously and will keep our communication transparent throughout this investigation.

 

[Rafael Diniz]

Hi Charles,

I have already requested this information from the customer, as soon as he provides it I will insert it here in the ticket.

See you soon

 

[Charles_3CX]

Thanks for the update. We will await your reply. In the meantime, you may also open a ticket with the ESET, as they require the ESET license key to do so, and provide them the information and log from the ESET AV for them to review.

 

[Rafael Diniz]

Charles,

3CX Server - 18.0.8.935
Desktop Version - 16.3.0.264

We still haven't received a response from ESET

Tks

 

[Charles_3CX]

This version of the app you mention refers to the 3cx app for Windows (legacy app) the ESET report seems to point to the location where the Desktop app files are located. Can you please double-check?

 

[Rafael Diniz]

Yes, it's a legacy version, I already asked the customer to update.

The path pointed out in the alert is yes the installation path of the application.

 

[Charles_3CX]

Please note that the install path of the 3CX Desktop app is:
C:\Users\%username%\AppData\Local\Programs\3CXDesktopApp
The provisioning and profile path is:
C:\Users\%username%\AppData\Roaming\3CXDesktopApp

The 3cx app for Windows is installed under:
C:\ProgramData\3CXPhone for Windows\PhoneApp
The profile is found under:
C:\Users\ce_3cx\AppData\Roaming\3CXPhone for Windows

ESET report states C:\Users\paulo\AppData\Roaming\3CXDesktopApp, which is the profile path for the 3CX Desktop app and not the 3CX App for Windows.

The legacy app does not have an updated version as it is no longer being developed. Check the version of the Desktop app, please.

 

[Rafael Diniz]

OK, I asked the customer to confirm the version installed on this computer that generated the alert.

As soon as he answers me I will update the ticket

 

[Rafael Diniz]

The version installed on this computer that generated the alert is 10.18.461

 

[Charles_3CX]

Thanks for the reply. So, to be precise, and for the sake of clarity, the 3CX Desktop app versions for v18 can be found here: https://www.3cx.com/blog/change-log/phone-system-change-log/

Which version from the guide above matches the 3CX Desktop app installed on the computer that reports the alert?

 

[NikosT_3CX]

Hi, we can understand that yesterday was a public holiday for you but can we have an update on this ?

 

[Rafael Diniz]

Sorry, due to the holiday I did not hear back from the customer.

This information was provided by the customer.

I will request a print of the installed version

 

[Charles_3CX]

Thanks for the reply. Please do let us know, and also what has been said by ESET regarding the log.

 

[NikosT_3CX]

@Rafael M. Diniz any update on this?

 

[Charles_3CX]

We are setting this to a false positive as no updates have been received, and we have not received any similar reports as the one mentioned.

Please continue with ESET to discover why their software reports the desktop app process this way.