SocGholish Disruption & Okendo Supply Chain: C2 Infrastructure and RAT Loader Analysis

---
title: Potential SocGholish Fake Browser Update Activity
id: 0e7b3b1e-8c5a-4a6b-9f1c-3d2e5f6a7b8c
description: Detects potential execution of SocGholish fake browser update scripts often delivered via compromised WordPress sites.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://www.infoblox.com/blog/threat-intelligence/hot-take-operation-endgame-vs-socgholish/
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Image|endswith:
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - 'update'
            - 'chrome_installer'
            - 'software_update'
    condition: selection
falsepositives:
    - Legitimate software updates initiated by browser
level: high
---
title: Okendo Reviews Malicious Script Connection
id: f1c2d3e4-5678-90ab-cdef-1234567890ab
description: Detects network connections to known malicious domains used in the Okendo Reviews supply chain attack.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'wigetticks.com'
            - 'wizzleticks.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: NetSupport RAT Installation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects installation of NetSupport Manager, often used as a RAT in the Okendo and Middle East campaigns.
status: experimental
date: 2026/06/21
author: Security Arsenal
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\client32.exe'
            - '\pcsu.exe'
            - '\NetSupport Manager'
    condition: selection
falsepositives:
    - Legitimate administrative software installation
level: medium


kql
// Hunt for SocGholish related domain connections
DeviceNetworkEvents
| where RemoteUrl has_any ("trademark.iglesiaelarca.com", "content.garretttrails.org", "promo.summat10n.org", "billing.roofnrack.us", "devel.asurans.com", "storehouse.beautysupplysalonllc.com", "samples.addisgraphix.com", "api-app.uppercrafteroom.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// Hunt for Okendo Supply Chain C2 connections
DeviceNetworkEvents
| where RemoteUrl contains "wigetticks.com" or RemoteUrl contains "wizzleticks.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// Hunt for NetSupport RAT process execution
DeviceProcessEvents
| where ProcessName in~ ("client32.exe", "pcsu.exe") or FolderPath contains "NetSupport"
| project Timestamp, DeviceName, ProcessName, FolderPath, InitiatingProcessFileName, SHA256


powershell
# IOC Hunt Script: Okendo & NetSupport Check
# Check for NetSupport RAT Installation Paths
$paths = @(
    "C:\Program Files\NetSupport\NetSupport Manager\",
    "C:\Program Files (x86)\NetSupport\NetSupport Manager\",
    "$env:APPDATA\NetSupport",
    "$env:TEMP\client32.exe"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Write-Host "[!] Potential NetSupport RAT found at: $path" -ForegroundColor Red
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
    }
}

# Check DNS Cache for SocGholish Domains
$domains = @(
    "trademark.iglesiaelarca.com",
    "content.garretttrails.org",
    "promo.summat10n.org",
    "api.wigetticks.com",
    "api.wizzleticks.com"
)

Write-Host "Checking DNS Cache for malicious domains..."
$dnsEntries = Get-DnsClientCache
foreach ($domain in $domains) {
    $found = $dnsEntries | Where-Object { $_.Entry -like "*$domain*" }
    if ($found) {
        Write-Host "[!] Malicious domain found in DNS Cache: $domain" -ForegroundColor Yellow
    }
}