title: Potential SmartApeSG Okendo C2 Connection
id: 4f2b9c8d-1a3e-4b5c-8d6e-7f8a9b0c1d2e
description: Detects network connections to known SmartApeSG C2 domains associated with the Okendo Reviews supply chain attack.
status: experimental
date: 2026/06/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'api.wigletticks.com'
            - 'api.wizzleticks.com'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: SocGholish Fake Browser Update Pattern
description: Detects execution of wscript.exe or cscript.exe with arguments typical of SocGholish fake browser update payloads.
id: 3e1d2c9b-4a5f-6e7d-8b9c-0a1b2c3d4e5f
status: experimental
date: 2026/06/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli:
        CommandLine|contains:
            - '.js'
            - 'jscript'
    selection_update_keywords:
        CommandLine|contains:
            - 'update'
            - 'chrome'
            - 'browser'
    condition: all of selection_
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: INC Ransomware Cobalt Strike Spawn Pattern
description: Detects suspicious process execution patterns often associated with Cobalt Strike beacons used by INC Ransomware (Brave Prince).
id: 5f6e7d8c-9b0a-1b2c-3d4e-5f6a7b8c9d0e
status: experimental
date: 2026/06/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\cmd.exe'
    selection_child:
        Image|endswith:
            - '\rundll32.exe'
            - '\powershell.exe'
            - '\regsvr32.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'Invoke-'
    condition: all of selection_
falsepositives:
    - Legitimate software updates
level: medium

// Hunt for connections to known SocGholish compromised hostnames and Okendo C2
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'trademark.iglesiaelarca.com', 
    'content.garretttrails.org', 
    'promo.summat10n.org', 
    'billing.roofnrack.us', 
    'api.wigletticks.com', 
    'api.wizzleticks.com'
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort
;

// Hunt for INC Ransomware associated file hash
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 == '6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141'
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName

<#
.SYNOPSIS
    Hunt script for INC Ransomware IOCs and SmartApeSG C2 domains.
.DESCRIPTION
    Checks the file system for the specific INC SHA256 hash and DNS cache for C2 domains.
#>

$IncHash = "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"
$SuspiciousDomains = @(
    "api.wigletticks.com",
    "api.wizzleticks.com",
    "trademark.iglesiaelarca.com",
    "billing.roofnrack.us"
)

Write-Host "[+] Hunting for INC Ransomware Hash..."
# Search C: drive for the hash (restricts to common executable extensions for performance)
Get-ChildItem -Path "C:\" -Recurse -Include *.exe, *.dll -ErrorAction SilentlyContinue | 
    ForEach-Object { 
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -eq $IncHash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking DNS Cache for C2 Domains..."
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $SuspiciousDomains) {
    if ($DnsCache | Where-Object { $_.Entry -like "*$domain*" }) {
        Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND: $domain" -ForegroundColor Yellow
    }
}

Write-Host "[+] Hunt Complete."


# Response Priorities

*   **Immediate:**
    *   Block all IOCs listed in the "IOC Analysis" section at the perimeter firewall and proxy.
    *   Inspect web traffic for the Okendo widget URL `cdn-static.okendo.io` and block requests to `api.wigletticks.com` and `api.wizzleticks.com`.
    *   Scan endpoints for the SHA256 hash `6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141`.

*   **24 Hours:**
    *   Initiate credential rotation for accounts active on devices where suspicious browser activity (fake updates) or RAT processes (NetSupport, Remcos) were detected.
    *   Patch systems against CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, and CVE-2025-5777 to prevent INC Ransomware initial access.

*   **1 Week:**
    *   Audit all third-party JavaScript libraries and widgets (supply chain) on public-facing e-commerce properties.
    *   Implement strict allow-listing for software updates to prevent fake update infections.
    *   Review backup integrity for Linux/ESXi systems given INC's Rust-based cross-platform encryptors.