Operation Endgame Disruption & Shai-Hulud Supply Chain: TA569, GoldFactory, and NPM Threats

---
title: Potential Fake Browser Update Activity - TA569 SocGholish
id: c48f9516-3f72-4f9b-8a0e-321e8430a9a2
status: experimental
description: Detects potential SocGholish fake browser update activity initiated by browser processes spawning PowerShell or cmd.
references:
    - https://otx.alienvault.com/pulse/6673a2c7c1f4e44f86550173
author: Security Arsenal
date: 2026/06/20
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'downloadstring'
            - 'iex'
            - 'copyitem'
    condition: selection
falsepositives:
    - Legitimate system administration tools launched via browser downloads
level: high
---
title: Suspicious NPM Package Execution - Shai-Hulud
id: d59e0627-4g83-5f0c-9b1f-432f9541b0a3
status: experimental
description: Detects execution of node.js processes making network connections to suspicious DGA-like domains associated with Shai-Hulud.
references:
    - https://otx.alienvault.com/pulse/6673a2c7c1f4e44f86550174
author: Security Arsenal
date: 2026/06/20
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\node.exe'
        Initiated: 'true'
    filter_legit:
        DestinationHostname|endswith:
            - 'npmjs.org'
            - 'github.com'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate development tools accessing non-standard internal registries
level: medium
---
title: GoldFactory C2 Infrastructure Communication
id: e70f1738-5h94-6g1d-0c2g-543g0652c1b4
status: experimental
description: Detects network connections to known GoldFactory C2 domains used in Gigabud.RAT campaigns.
references:
    - https://otx.alienvault.com/pulse/6673a2c7c1f4e44f86550175
author: Security Arsenal
date: 2026/06/20
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'sso-tha.com'
            - 'lhr.life'
    condition: selection
falsepositives:
    - Unknown
level: critical

// Hunt for GoldFactory and Shai-Hulud Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "platform.exathomeswebuyarizona.com", 
    "js-new.newtoyourgame.com", 
    "87e0bbc636999b.lhr.life", 
    "edcf8b03c84634.lhr.life",
    "sso-tha.com"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend IoC_Type = "C2_Domain"
;

// Hunt for Malicious File Hashes (GoldFactory)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA1 in_any (
    "004d80e0efe9ea4d572350e8ce4771dfa432f0a2",
    "00fcb2abd35049ad3cc9a8a3e1aaba156c0770cf",
    "02462bace6937e92f3d1ef35f08c4ad270082104",
    "036aa79692470ad8d6a3bedb5da310af111317af",
    "03a1bcd3ba59c02ce6c37699baa73a2c075a6644"
)
| project Timestamp, DeviceName, FileName, SHA1, InitiatingProcessAccountName
| extend IoC_Type = "Malware_Hash"

<#
.SYNOPSIS
    Hunt script for SocGholish and Shai-Hulud Indicators of Compromise.
.DESCRIPTION
    Checks DNS Cache for malicious domains and running processes for suspicious connections.
#>

$MaliciousDomains = @(
    "platform.exathomeswebuyarizona.com",
    "js-new.newtoyourgame.com",
    "87e0bbc636999b.lhr.life",
    "edcf8b03c84634.lhr.life",
    "sso-tha.com"
)

Write-Host "[+] Checking DNS Cache for malicious domains..."
$DNSCache = Get-DnsClientCache
foreach ($domain in $MaliciousDomains) {
    $hit = $DNSCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($hit) {
        Write-Host "[!] ALERT: Found malicious domain in DNS cache: $($domain)" -ForegroundColor Red
    }
}

Write-Host "[+] Checking for active connections to suspicious endpoints..."
$TCPConnections = Get-NetTCPConnection -State Established
foreach $conn in $TCPConnections) {
    $ProcessName = (Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $RemoteIP = $conn.RemoteAddress
    try {
        $RemoteHost = [System.Net.Dns]::GetHostEntry($RemoteIP).HostName
        foreach ($domain in $MaliciousDomains) {
            if ($RemoteHost -like "*$domain*") {
                Write-Host "[!] ALERT: Active connection to $domain detected via $ProcessName (PID: $($conn.OwningProcess))" -ForegroundColor Red
            }
        }
    } catch {
        # Reverse DNS lookup failed, ignore
    }
}

Write-Host "[+] Hunt complete."