Operation Endgame Aftermath: SocGholish, INC Ransomware, and Okendo Supply Chain Analysis

---
title: Potential SocGholish Fake Browser Update Execution
id: 8b6e36e7-6c7f-4a6b-9e5f-3c8b1a2d3e4f
description: Detects execution of JScript files often associated with fake browser update campaigns dropped by SocGholish.
status: experimental
date: 2026/06/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/operation-endgame-vs-socgholish/
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - '.js'
            - 'jscript'
    selection_keywords:
        CommandLine|contains:
            - 'update'
            - 'chrome'
            - 'firefox'
            - 'browser'
    condition: selection and selection_keywords
falsepositives:
    - Legitimate software updates running via scripts (rare)
level: high
---
title: INC Ransomware Related CVE Exploitation Attempt
date: 2026/06/19
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation attempts of vulnerabilities associated with INC Ransomware activity.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/inc-ransomware-evolution/
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: web
    product: proxy
detection:
    selection_cve_1:
        c-uri|contains:
            - '/cgi-mod/index.py'
            - '/oauth/idp/.well-known/openid-configuration' # Generic patterns often associated with Citrix/ADCS vulns
    selection_cve_2:
        cs-uri-query|contains:
            - ' exploits'
            - 'shell'
    filter:
        sc-status:
            - 200
            - 404
    condition: selection_cve_1 or selection_cve_2
falsepositives:
    - Vulnerability scanners
level: medium
---
title: Okendo Supply Chain Malicious Connection
date: 2026/06/19
id: f1e2d3c4-b5a6-7890-cdef-1234567890ab
description: Detects outbound connections to known malicious domains used in the Okendo Reviews supply chain attack.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/okendo-reviews-supply-chain-attack/
tags:
    - attack.initial_access
    - attack.t1195
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'wigetticks.com'
            - 'wizzleticks.com'
    condition: selection
falsepositives:
    - Unknown
level: critical

// Hunt for connections to compromised SocGholish hostnames
DeviceNetworkEvents
| where RemoteUrl in~ ("trademark.iglesiaelarca.com", "content.garretttrails.org", "promo.summat10n.org", "billing.roofnrack.us", "devel.asurans.com", "storehouse.beautysupplysalonllc.com", "samples.addisgraphix.com", "api-app.uppercrafteroom.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
;
// Hunt for connections to SmartApeSG C2 domains
DeviceNetworkEvents
| where RemoteUrl has_any ("wigetticks.com", "wizzleticks.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort
;
// Hunt for INC Ransomware related file hash
DeviceFileEvents
| where SHA256 == "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName

<#
.SYNOPSIS
   IOC Hunt for SocGholish, INC Ransomware, and Okendo Supply Chain Indicators.
#>

# IOC Lists
$SocGholishHosts = @("trademark.iglesiaelarca.com", "content.garretttrails.org", "promo.summat10n.org", "billing.roofnrack.us", "devel.asurans.com", "storehouse.beautysupplysalonllc.com", "samples.addisgraphix.com", "api-app.uppercrafteroom.com")
$MaliciousHash = "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"
$MaliciousDomains = @("wigetticks.com", "wizzleticks.com")

Write-Host "[+] Hunting for INC Ransomware File Hash..." -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0 } | ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($hash -eq $MaliciousHash) {
        Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
    }
}

Write-Host "[+] Checking DNS Cache for Malicious Domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache | Where-Object { $SocGholishHosts -contains $_.Entry -or $MaliciousDomains -contains $_.Entry }
if ($dnsCache) {
    Write-Host "[!] Suspicious DNS Cache Entries found:" -ForegroundColor Red
    $dnsCache | Format-Table Entry, Data, Type
}

Write-Host "[+] Checking Browser History for Okendo Malicious URLs..." -ForegroundColor Cyan
# Note: Accessing browser history usually requires parsing specific database files (SQLite). This is a placeholder for path checks.
$UserProfiles = Get-ChildItem "C:\Users"
foreach ($profile in $UserProfiles) {
    $chromePath = Join-Path $profile.FullName "AppData\Local\Google\Chrome\User Data\Default\History"
    if (Test-Path $chromePath) {
        Write-Host "[INFO] Chrome History found for $($profile.Name). Manual forensic review required for 'wigetticks.com' or 'wizzleticks.com'." -ForegroundColor Yellow
    }
}