Operation Endgame, SocGholish Takedowns, and FortiBleed Credential Harvesting: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential SocGholish Fake Browser Update Activity
id: 663dafe3-5975-4cb5-9d0d-c8d1d2c0f7e6
description: Detects potential SocGholish activity by identifying processes launched from a parent process that is a web browser and the child process is a scripting host like wscript.exe or cscript.exe, a common pattern for its JScript dropper.
status: stable
author: Security Arsenal Research
date: 2026/06/22
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains: '.js'
    condition: selection
falsepositives:
    - Legitimate administrative scripts launched from a browser download.
level: high
---
title: Suspicious Process Created by Office Word
id: d12e45d8-8c5f-46b3-8294-914b9ec2e72a
description: Detects when Microsoft Word (winword.exe) creates a child process like powershell.exe or cmd.exe, a common technique used in maldoc campaigns to download and execute payloads, potentially related to infostealers like LummaC2 or Vidar.
status: stable
author: Security Arsenal Research
date: 2026/06/22
references:
    - https://otx.alienvault.com/
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\winword.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    condition: selection
falsepositives:
    - Macros used for legitimate automation purposes.
level: high
---
title: FortiGate SSL VPN Brute Force Login Activity
id: 7f2a5cde-8c6e-4f8d-9d3b-a7b5c9d0e1f2
description: Detects multiple failed login attempts on FortiGate SSL VPN within a short time window, indicative of a credential harvesting or brute force attack like FortiBleed.
status: stable
author: Security Arsenal Research
date: 2026/06/22
references:
    - https://otx.alienvault.com/
tags:
    - attack.credential_access
    - attack.t1110.003
logsource:
    product: fortigate
    service: vpn
detection:
    selection:
        action|contains: 'sslvpn-login'
        status|contains: 'failure'
    timeframe: 5m
    condition: selection | count() > 10
falsepositives:
    - Users genuinely forgetting their password.
level: high

// Hunt for connections to known malicious hostnames/domains from pulses
DeviceNetworkEvents
| where RemoteUrl has_any (
    "trademark.iglesiaelarca.com", "content.garretttrails.org", "promo.summat10n.org", "billing.roofnrack.us",
    "devel.asurans.com", "storehouse.beautysupplysalonllc.com", "samples.addisgraphix.com", "api-app.uppercrafteroom.com",
    "comples.biz", "dafkov.shop", "ciuzdaw.shop", "ablackb.shop", "cloxaa.shop"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend Message = strcat('Device ', DeviceName, ' connected to malicious domain: ', RemoteUrl)


kql
// Hunt for processes with known malicious file hashes from pulses
DeviceProcessEvents
| where SHA256 has_any (
    "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c"
) or MD5 has_any (
    "0d1f6685b4e284f92ef25c0f9358bcdc"
) or SHA1 has_any (
    "7d5c1d672d6e4bef1a7ca4ca9849db74e8690213"
)
| project Timestamp, DeviceName, AccountName, FileName,FolderPath, SHA256, MD5, SHA1, InitiatingProcessFileName, InitiatingProcessAccountName
| extend Message = strcat('Malicious process execution detected on ', DeviceName, ' by ', AccountName, ': ', FileName)

<#
.SYNOPSIS
    IOC Hunt Script for SocGholish and FortiBleed Indicators.
.DESCRIPTION
    This script checks a Windows endpoint for file artifacts associated with the
    provided malicious file hashes and checks for any recent network connections
    to the provided IOCs. Note: Direct network connection hunting is limited on
    an endpoint; this script focuses on local artifacts.
.NOTES
    File Name      : Hunt-IOC.ps1
    Author         : Security Arsenal Research
    Prerequisite   : PowerShell 5.1 or later, Administrator privileges for some checks.
#>

# Malicious File Hashes from Pulse 3 (May 2026 Infostealer Trend Report)
$MaliciousHashes = @(
    "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c", # SHA256
    "0d1f6685b4e284f92ef25c0f9358bcdc",       # MD5
    "7d5c1d672d6e4bef1a7ca4ca9849db74e8690213"        # SHA1
)

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# Function to calculate file hash
function Get-FileHashLocal {
    param ([string]$FilePath)
    $fileStream = [System.IO.File]::OpenRead($FilePath)
    $sha256 = [System.Security.Cryptography.SHA256]::Create()
    $md5 = [System.Security.Cryptography.MD5]::Create()
    $sha1 = [System.Security.Cryptography.SHA1]::Create()
    $hashBytes256 = $sha256.ComputeHash($fileStream)
    $fileStream.Position = 0
    $hashBytesMD5 = $md5.ComputeHash($fileStream)
    $fileStream.Position = 0
    $hashBytesSHA1 = $sha1.ComputeHash($fileStream)
    $fileStream.Close()
    
    $hash256 = [System.BitConverter]::ToString($hashBytes256).Replace("-", "").ToLower()
    $hashMD5 = [System.BitConverter]::ToString($hashBytesMD5).Replace("-", "").ToLower()
    $hashSHA1 = [System.BitConverter]::ToString($hashBytesSHA1).Replace("-", "").ToLower()

    return @{ SHA256 = $hash256; MD5 = $hashMD5; SHA1 = $hashSHA1 }
}

# Search for files matching the malicious hashes
$DrivesToScan = @("C:") # Add more drives as needed
$MatchingFiles = @()

foreach ($drive in $DrivesToScan) {
    if (Test-Path $drive) {
        Write-Host "Scanning drive $drive for malicious file hashes..." -ForegroundColor Yellow
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $hashes = Get-FileHashLocal -FilePath $_.FullName
                if ($MaliciousHashes -contains $hashes.SHA256 -or $MaliciousHashes -contains $hashes.MD5 -or $MaliciousHashes -contains $hashes.SHA1) {
                    $MatchingFiles += [PSCustomObject]@{
                        FilePath = $_.FullName
                        SHA256   = $hashes.SHA256
                        MD5      = $hashes.MD5
                        SHA1     = $hashes.SHA1
                    }
                }
            } catch {
                # Ignore errors (e.g., permission denied, in-use files)
            }
        }
    }
}

if ($MatchingFiles.Count -gt 0) {
    Write-Host "[CRITICAL] Found $($MatchingFiles.Count) file(s) matching malicious hashes:" -ForegroundColor Red
    $MatchingFiles | Format-Table -AutoSize
} else {
    Write-Host "No files matching malicious hashes were found." -ForegroundColor Green
}

Write-Host "IOC Hunt complete." -ForegroundColor Cyan