Hi there. Engineer from CrowdStrike, here. To be clear: Falcon is not flagging the 3CX binary, I know everyone is a little twitchy, it is flagging whatever DesktopServicesHelper is writing to disk. If you read the alert:
This process wrote a suspicious file to disk. That associated file meets the ML algorithm's high-confidence malware detection threshold. Review the associated file.
I do not know a ton about the complete workings of 3CX, however, assumption is DesktopServicesHelper is a worker process that can write files to disk as required. It is whatever DesktopServicesHelper is writing that is triggering the alerts.
Recommendation would be to examine the files being written to disk by DesktopServicesHelper and ensure they are expected.
UPDATE
@dsapp appears to have pasted two detections above. I'll go one at a time. First is this one:
Crowdstrike Alert
Trigger Name: New detection
Indicators of Attack: This file meets the File Attribute ML algorithm's high-confidence threshold for malware.
Actions Taken: Prevention/Quarantine, process was blocked from execution and quarantine was attempted
Alert Details
Status: New
Severity: High
Local IP Address: (redacted)
Domain:
Username: (redacted)
Command Line: /Applications/3CX Desktop App.app/Contents/MacOS/3CX Desktop App
File Path: /Applications/3CX Desktop App.app/Contents/MacOS/3CX Desktop App
This appears to be a false positive and we've rectified it on our side. The ML model was getting overly aggressive with the 3CX binary as the previous, weaponized binary was trained upon. This has been fixed and we apologize for any heartburn, here.
Second is this:
Crowdstrike Alert
Trigger Name: New detection
Indicators of Attack: This process wrote a suspicious file to disk. That associated file meets the ML algorithm's high-confidence malware detection threshold. Review the associated file.
Actions Taken: Endpoint detection, standard detection
Alert Details
Status: New
Severity: Low
Local IP Address: (redacted)
Domain:
Username: root
Command Line: /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
File Path: /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper
This is part of the macOS operating system and, from what I can tell, unrelated to 3CX in any way.
Code:
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper
The launching process in all cases is
launchd. Falcon is flagging this binary when it is writing malicious files to disk.
@dsapp I would pay attention to these alerts and ensure that you expect this behavior in your environment.
If there are any other questions please let me know.
