GhostSocks Proxy & Remcos RAT: OTX Pulse Analysis — AI Framework & Mobile Link Exploits

title: Potential GhostSocks Proxy C2 Connection
id: 0a1b2c3d-4e5f-6789-0abc-1def23456789
description: Detects network connections to known GhostSocks C2 domains and infrastructure indicators.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789abcdef
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'retreaw.click'
            - 'bruggebogeyed.site'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.defense_evasion

---

title: Suspicious PowerShell MSI Download (OpenClaw/Remcos Vector)
id: 1a2b3c4d-5e6f-7890-bcde-1f234567890a
description: Detects PowerShell commands downloading MSI packages, a technique used in the OpenClaw DeepSeek-Claw attack to deliver Remcos RAT.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789abcdef
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadFile'
    selection_msi:
        CommandLine|contains: '.msi'
    condition: all of selection_*
falsepositives:
    - Legitimate software installation scripts
level: high
tags:
    - attack.initial_access
    - attack.execution

---

title: CloudZ RAT C2 IP Connection
id: 2b3c4d5e-6f78-9012-cdef-234567890abc
description: Detects connections to the IPv4 address associated with CloudZ RAT and Pheno plugin activity.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789abcdef
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp|startswith: '185.196.10.136'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.exfiltration

// Hunt for GhostSocks and Remcos C2 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("retreaw.click", "bruggebogeyed.site", "dropras.xyz", "trackpipe.dev")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

// Hunt for CloudZ RAT IP Connection
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP == "185.196.10.136"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort

// Hunt for Suspicious MSI Downloads via PowerShell (OpenClaw Vector)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "powershell.exe"
| where ProcessCommandLine has ".msi" and (ProcessCommandLine has "Invoke-WebRequest" or ProcessCommandLine has "DownloadFile")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine

<#
.SYNOPSIS
    Hunt script for GhostSocks, Remcos, and CloudZ artifacts.
.DESCRIPTION
    Checks DNS Cache for malicious domains and Active TCP connections for CloudZ C2 IP.
#>

Write-Host "[*] Starting OTX Pulse Hunt: GhostSocks / Remcos / CloudZ..." -ForegroundColor Cyan

$MaliciousDomains = @(
    "retreaw.click",
    "w2.bruggebogeyed.site",
    "dropras.xyz",
    "trackpipe.dev"
)
$MaliciousIP = "185.196.10.136"

# Check DNS Cache for C2 Domains
Write-Host "[*] Checking DNS Cache for GhostSocks/Remcos C2 Domains..."
$DnsCache = Get-DnsClientCache
foreach ($Domain in $MaliciousDomains) {
    $Matches = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Matches) {
        Write-Host "[!] ALERT: Found DNS Cache entry for $Domain" -ForegroundColor Red
        $Matches | Select-Object Entry, Data, TimeToLive
    }
}

# Check Active Network Connections for CloudZ IP
Write-Host "[*] Checking Active Connections for CloudZ C2 IP ($MaliciousIP)..."
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
$Matches = $Connections | Where-Object { $_.RemoteAddress -eq $MaliciousIP }
if ($Matches) {
    Write-Host "[!] ALERT: Found active connection to CloudZ C2 IP $MaliciousIP" -ForegroundColor Red
    $Matches | Select-Object LocalPort, RemotePort, OwningProcess
    # Resolve Process Name
    $Matches | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue | Select-Object ProcessName, Path }
} else {
    Write-Host "[-] No active connections found to $MaliciousIP." -ForegroundColor Green
}

Write-Host "[*] Hunt Complete."


---