GoSerpent Malware: Detection and Defense Strategies for Southeast Asian Diplomacy

---
title: Potential GoSerpent Execution - Suspicious Unsigned Go Binary
id: 8a2b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects execution of unsigned Go binaries (Company Name: Go) in user-writable paths, indicative of GoSerpent or similar droppers.
references:
  - https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '.exe'
    CompanyName: 'Go'
    Signed: 'false'
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Desktop\'
      - '\AppData\Roaming\'
  condition: selection
falsepositives:
  - Legitimate portable tools used by administrators
level: high
---
title: Suspicious Scheduled Task Creation for Long-Term Access
id: 9b3c5d6e-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Detects the creation of scheduled tasks by non-admin users or utilizing unusual triggers, a common persistence method for espionage tools like GoSerpent.
references:
  - https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/sc'
      - '/tn'
  filter_admin:
    SubjectUserName|contains:
      - 'ADMIN'
      - 'SYSTEM'
  condition: selection and not filter_admin
falsepositives:
  - User-initiated task scheduling
level: medium

// Hunt for unsigned Go binaries often used in GoSerpent style campaigns
// Focus on processes spawned from user directories to avoid noise from signed Go services
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessVersionInfoCompanyName == "Go" 
| where IsSigned == false 
| where FolderPath contains "Users"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by Timestamp desc

-- Hunt for recently modified executables in user directories characteristic of GoSerpent droppers
SELECT FullPath, Size, Mtime, Mode, Sys.OSPath.Basename(Name) as Name
FROM glob(globs='/*', root=srcDir='C:/Users/')
WHERE Mode =~ 'x' 
  AND Mtime > now() - 180 
  AND Name =~ '\.(exe|dll)$'
  AND NOT FullPath =~ '\\AppData\\Local\\Microsoft\\'

# Security Arsenal - GoSerpent Response Audit
# Scans for unsigned Go binaries in user directories

Write-Host "Starting audit for suspicious Go binaries..."

$paths = @("C:\Users\*\Downloads\*.exe", "C:\Users\*\Desktop\*.exe", "C:\Users\*\AppData\Local\Temp\*.exe", "C:\Users\*\AppData\Roaming\*.exe")
$findings = @()

foreach ($path in $paths) {
    Get-ChildItem -Path $path -ErrorAction SilentlyContinue | ForEach-Object {
        $file = $_
        try {
            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
            # Check for unsigned files or files with CompanyName matching Go
            $versionInfo = $file.VersionInfo
            if ($sig.Status -ne 'Valid' -and $versionInfo.CompanyName -eq 'Go') {
                $findings += [PSCustomObject]@{
                    Path = $file.FullName
                    Status = $sig.Status
                    Company = $versionInfo.CompanyName
                    Time = $file.LastWriteTime
                }
            }
        } catch {
            # Ignore errors accessing locked files
        }
    }
}

if ($findings.Count -gt 0) {
    Write-Host "[!] Potential GoSerpent artifacts found:" -ForegroundColor Red
    $findings | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious unsigned Go binaries found in user directories." -ForegroundColor Green
}