Detect TrueConf Client Download of Code Without Integrity Check (CVE-2026-3502) in CrowdStrike LogScale
Detects exploitation of CVE-2026-3502, a CWE-494 (Download of Code Without Integrity Check) vulnerability in TrueConf Client. An attacker with a network position to intercept or manipulate TrueConf Client update/download channels can deliver unsigned or tampered code to client systems, enabling arbitrary code execution. This CVE is listed on the CISA KEV catalog, indicating active exploitation in the wild.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
LogScale Detection Query
event_simpleName IN ("ProcessRollup2", "ClassifiedModuleLoad", "PartiallyClassifiedModuleLoad", "NewExecutableWritten")
| ImageFileName LIKE "%TrueConf%" OR ParentBaseFileName LIKE "%TrueConf%" OR TargetFileName LIKE "%TrueConf%"
| case(
event_simpleName IN ("ClassifiedModuleLoad", "PartiallyClassifiedModuleLoad")
AND (SignInfoFlags != "0" OR MicrosoftSecuritySigning = "0"),
"unsigned_module_load",
event_simpleName = "NewExecutableWritten"
AND (TargetFileName LIKE "%Temp%" OR TargetFileName LIKE "%AppData%" OR TargetFileName LIKE "%update%"),
"executable_drop_update_path"
) AS risk_type
| risk_type != ""
| groupBy([ComputerName, UserName, ImageFileName, TargetFileName, SHA256HashData, risk_type], function=count(1, as=EventCount))
| sort(EventCount, order=desc)CrowdStrike Falcon Query Language detection for TrueConf Client writing new executables to temp/update locations or loading unsigned modules, representing exploitation attempts via CVE-2026-3502 tampered update delivery.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike sensor exclusions on TrueConf update directories masking partial events
- Legitimate patch Tuesday TrueConf updates deployed via enterprise software manager to temp paths
- Digital forensics tooling executing alongside TrueConf installer in controlled analysis environment
Other platforms for CVE-2026-3502
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate TrueConf Tampered Update File Drop
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename matching *\AppData\*TrueConf*\update\*.exe and Image matching the PowerShell process.
- Test 2Simulate TrueConf Process Loading Unsigned DLL
Expected signal: Sysmon Event ID 7 (ImageLoad) with ImageLoaded matching the DLL path; Signed field may be true for the copied system DLL — use an unsigned compiled DLL in a real lab for more accurate telemetry.
- Test 3Simulate TrueConf Update Outbound Connection to Non-Official Domain
Expected signal: Sysmon Event ID 3 (NetworkConnect) with DestinationIp 192.0.2.1 and DestinationPort 80; process name will show powershell.exe rather than TrueConf in lab — in a real test, rename the script host or use a TrueConf process injection method.
- Test 4Enumerate TrueConf Version and Update Configuration from Registry
Expected signal: Sysmon Event ID 13 (RegistryValueSet) will NOT fire for reads; process-level telemetry via Event ID 1 shows powershell.exe querying TrueConf registry paths. EDR behavioral telemetry should capture registry read operations.
Response Playbook
Triage
- Confirm the affected host has TrueConf Client installed and identify the installed version by checking registry key HKLM\SOFTWARE\TrueConf or HKLM\SOFTWARE\WOW6432Node\TrueConf for version information.
- Review the file system for recently created or modified executable files (EXE, DLL, MSI) in TrueConf-related temp and update directories (e.g., %APPDATA%\TrueConf, %TEMP%\TrueConf*) and collect SHA256 hashes for reputation lookup.
- Check network connections made by TrueConf processes around the time of the alert — look for connections to non-TrueConf infrastructure (unexpected IPs, domains not matching trueconf.com) that could indicate update server spoofing.
- Validate the code signature on any suspicious executables dropped by TrueConf using sigcheck.exe or PowerShell Get-AuthenticodeSignature to determine if tampered files are unsigned or carry an invalid certificate.
Containment
- Isolate the affected endpoint from the network using your EDR's network containment feature to prevent lateral movement or C2 callbacks if a tampered payload has already executed.
- Block TrueConf update mechanisms at the perimeter firewall and proxy by denying outbound connections to non-official TrueConf update hostnames until the vulnerability is patched and the update mechanism integrity is confirmed.
Evidence Collection
- Collect memory dump of any running TrueConf processes (trueconf.exe) using ProcDump or your EDR's memory acquisition feature to capture injected code, decrypted payloads, or in-memory artifacts.
- Export relevant Sysmon/EDR telemetry (process creation, file creation, network events, image load events) for the affected host for the 2-hour window surrounding the first alert timestamp and preserve to a forensic share.
Escalation Criteria
- !Escalate immediately if tampered TrueConf executables have been executed (not merely written) on the host, particularly if followed by new scheduled tasks, service creation, or outbound network connections to unusual infrastructure.
- !Escalate if more than one host triggers this detection within a 24-hour window, which may indicate a supply-chain or network-level interception campaign rather than an isolated incident.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry keys under HKLM\SOFTWARE\TrueConf and HKCU\SOFTWARE\TrueConf for version, update URL configuration, and last update timestamp. - >
Files in %APPDATA%\TrueConf\, %TEMP%\TrueConf*, and %PROGRAMFILES%\TrueConf\ — particularly any EXE or DLL with a modification timestamp matching the alert window. - >
Windows Event Log entries (Event ID 4688 process creation, Event ID 7045 service installation) for processes spawned from TrueConf directories. - >
Prefetch files for trueconf.exe and any co-located executables to determine execution frequency and loaded DLLs.
Tuning Guidance
Reduce false positives by scoping the detection to TrueConf versions confirmed vulnerable (review vendor advisory for patched version number and exclude patched installs by version). Add allow-list exceptions for your organization's internal software distribution servers if TrueConf is deployed via SCCM/Intune. For the unsigned module load detections, build a baseline of TrueConf's expected signed DLL set and alert only on deviations from that baseline. Increase confidence by correlating file write events with subsequent process execution events from the same file path.
Hunting Queries
Hunt for TrueConf processes making outbound network connections to infrastructure outside the official TrueConf domains, which may indicate update server spoofing or C2 communication post-exploitation.
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("TrueConf", "trueconf")
| where RemoteUrl !has "trueconf.com" and RemoteUrl !has "trueconf.ru"
| where RemotePort in (80, 443, 8080, 8443)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp descindex=endpoint (sourcetype=sysmon OR sourcetype=crowdstrike:events:sensor)
EventCode=3 Image="*TrueConf*"
NOT (DestinationHostname="*trueconf.com" OR DestinationHostname="*trueconf.ru")
| table _time, host, Image, DestinationIp, DestinationHostname, DestinationPort
| sort -_timeAtomic Red Team Tests
Mimics the file artifact left by a tampered TrueConf update — writes a benign executable to the TrueConf AppData update path to trigger file-creation based detections without executing malicious code.
Command
New-Item -ItemType Directory -Force -Path "$env:APPDATA\TrueConf\update" | Out-Null; Copy-Item -Path "C:\Windows\System32\calc.exe" -Destination "$env:APPDATA\TrueConf\update\TrueConfSetup_tampered.exe"; Write-Host 'Artifact written to simulate tampered TrueConf update drop'Cleanup
Remove-Item -Force "$env:APPDATA\TrueConf\update\TrueConfSetup_tampered.exe" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) with TargetFilename matching *\AppData\*TrueConf*\update\*.exe and Image matching the PowerShell process.
Expected Detection
SPL and KQL file-creation detections should fire on the executable drop to the TrueConf update path.
Creates an unsigned DLL in the TrueConf temp directory and uses rundll32 launched as a child of a renamed TrueConf-named process to simulate unsigned module load behavior.
Command
New-Item -ItemType Directory -Force -Path "$env:TEMP\TrueConfSim" | Out-Null; Copy-Item "C:\Windows\System32\msftedit.dll" "$env:TEMP\TrueConfSim\unsigned_plugin.dll"; $proc = Start-Process -FilePath "C:\Windows\System32\rundll32.exe" -ArgumentList "$env:TEMP\TrueConfSim\unsigned_plugin.dll,DllMain" -PassThru -Wait; Write-Host "Simulated unsigned DLL load by PID $($proc.Id)"Cleanup
Remove-Item -Recurse -Force "$env:TEMP\TrueConfSim" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 7 (ImageLoad) with ImageLoaded matching the DLL path; Signed field may be true for the copied system DLL — use an unsigned compiled DLL in a real lab for more accurate telemetry.
Expected Detection
Image load detections targeting unsigned or tampered modules in TrueConf-related temp paths should partially match; full fidelity requires a truly unsigned DLL artifact.
Uses PowerShell to make an outbound HTTP request from a process named to simulate TrueConf connecting to a non-official domain, testing network-based hunting queries.
Command
Invoke-WebRequest -Uri 'http://192.0.2.1/trueconf_update_check' -TimeoutSec 5 -ErrorAction SilentlyContinue; Write-Host 'Simulated TrueConf non-official update server connection attempt (connection will fail by design)'Cleanup
No cleanup required — network connection attempt only, no files written.Expected Telemetry
Sysmon Event ID 3 (NetworkConnect) with DestinationIp 192.0.2.1 and DestinationPort 80; process name will show powershell.exe rather than TrueConf in lab — in a real test, rename the script host or use a TrueConf process injection method.
Expected Detection
Network hunting queries filtering on TrueConf processes connecting to non-trueconf.com/ru domains should alert; lab telemetry may show powershell.exe and require query tuning for simulation accuracy.
Reads TrueConf registry keys to extract installed version and configured update URL, simulating reconnaissance an attacker would perform to identify vulnerable targets.
Command
Get-ItemProperty -Path 'HKLM:\SOFTWARE\TrueConf' -ErrorAction SilentlyContinue; Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\TrueConf' -ErrorAction SilentlyContinue; Get-ItemProperty -Path 'HKCU:\SOFTWARE\TrueConf' -ErrorAction SilentlyContinue | Select-Object *Cleanup
No cleanup required — read-only registry query.Expected Telemetry
Sysmon Event ID 13 (RegistryValueSet) will NOT fire for reads; process-level telemetry via Event ID 1 shows powershell.exe querying TrueConf registry paths. EDR behavioral telemetry should capture registry read operations.
Expected Detection
Not directly detected by the primary detection rule; used to validate forensic artifact hunting and confirm TrueConf version for patching prioritization.