Operation Endgame Aftermath: SocGholish Disruption & AI-Generated ClickFix Infostealers

title: Potential SocGholish Fake Browser Update Activity
id: 9a6c4e1c-1b2d-4c3d-8e5f-6a7b8c9d0e1f
description: Detects execution patterns associated with SocGholish fake browser updates, typically involving wscript.exe or mshta.exe launching suspicious JScript payloads.
status: experimental
date: 2026/06/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/624567890abcdef
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Image|endswith:
            - '\wscript.exe'
            - '\mshta.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'update'
            - 'install'
            - 'chrome' 
            - '.js'
    condition: selection
falsepositives:
    - Legitimate software updates initiated by browser
level: high
tags:
    - attack.initial_access
    - attack.t1189
---
title: AI-Generated ClickFix PowerShell Execution
id: b7d5e2f3-4c6a-8d9e-0f1a-2b3c4d5e6f7a
description: Detects PowerShell commands spawned by browsers characteristic of ClickFix campaigns, often involving base64 encoding or clipboard manipulation.
status: experimental
date: 2026/06/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/624567890abcdef
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    selection_image:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - 'FromBase64String'
            - 'clipboard'
            - 'iex'
            - 'invoke-expression'
    condition: all of selection_*
falsepositives:
    - Legitimate web-based management tools
level: critical
tags:
    - attack.execution
    - attack.t1059.001
---
title: Okendo Supply Chain Malicious JS Connection
id: c1e2d3f4-a5b6-c7d8-e9f0-1a2b3c4d5e6f
description: Detects network connections to known malicious domains associated with the Okendo Reviews widget supply chain attack.
status: experimental
date: 2026/06/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/624567890abcdef
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated|equals: 'true'
        DestinationHostname|contains:
            - 'wigetticks.com'
            - 'wizzleticks.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Hunt for SocGholish and ClickFix related network connections and process creations
let SuspiciousDomains = dynamic(['trademark.iglesiaelarca.com', 'content.garretttrails.org', 'crefisa.online', 'windowsupdate-cdn.com']);
// DeviceNetworkEvents for C2 connections
DeviceNetworkEvents
| where RemoteUrl in (SuspiciousDomains) or RemoteIP in ('162.141.111.227')
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend IOCPType = 'NetworkConnection'
| union ( 
    // DeviceProcessEvents for Fake Update and PowerShell patterns
    DeviceProcessEvents
    | where (InitiatingProcessFileName in ('chrome.exe', 'firefox.exe', 'msedge.exe') and 
            (FileName in ('wscript.exe', 'mshta.exe', 'powershell.exe') or 
             ProcessCommandLine has_any ('update', 'chrome', 'FromBase64String', 'clipboard')
            )
           )
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend IOCPType = 'ProcessCreation'
)
| order by Timestamp desc

# Hunt for SmartRAT, Remcos, and SocGholish artifacts
# Check for suspicious processes associated with the Pulse data
$suspiciousProcesses = @('powershell.exe', 'wscript.exe', 'mshta.exe', 'regsvr32.exe')
$suspiciousParents = @('chrome.exe', 'firefox.exe', 'msedge.exe')

Write-Host "Checking for processes spawned by browsers matching suspicious criteria..."
Get-Process | Where-Object { 
    $suspiciousParents -contains $_.Parent.ProcessName -and 
    $suspiciousProcesses -contains $_.ProcessName 
} | Select-Object Id, ProcessName, Parent, Path | Format-Table -AutoSize

# Check for connections to IOCs (requires admin)
$targetDomains = @('trademark.iglesiaelarca.com', 'crefisa.online', 'wigetticks.com', 'wizzleticks.com')
Write-Host "Checking active network connections for malicious domains..."
$activeConnections = Get-NetTCPConnection | Select-Object -ExpandProperty RemoteAddress | ForEach-Object { 
    try { [System.Net.Dns]::GetHostEntry($_) } catch { } 
} | Where-Object { $targetDomains -contains $_.HostName }

if ($activeConnections) {
    Write-Host "WARNING: Found active connections to known malicious domains:" -ForegroundColor Red
    $activeConnections | Select-Object HostName, AddressList
} else {
    Write-Host "No active connections to known malicious domains found."
}

# Check for SmartRAT/Remcos persistence in Registry
$regPaths = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 
               'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
Write-Host "Checking Registry for suspicious persistence keys..."
foreach ($path in $regPaths) {
    if (Test-Path $path) {
        Get-Item -Path $path | Select-Object -ExpandProperty Property | ForEach-Object {
            $propVal = (Get-ItemProperty -Path $path -Name $_).$_
            if ($propVal -match 'powershell' -or $propVal -match 'javascript' -or $propVal -match '.js') {
                Write-Host "Suspicious Key in $path : $_ = $propVal" -ForegroundColor Yellow
            }
        }
    }
}