SocGholish Disruption & Okendo Supply Chain: Fake Updates and Third-Party Widget Compromise

---
title: Suspicious Browser Update Script Download
description: Detects the download of JS files often used in SocGholish fake update campaigns.
references:
    - https://otx.alienvault.com/pulse/6243829123472000/
author: Security Arsenal
date: 2026/06/22
status: stable
logsource:
    category: proxy
definition: 'Requirements: Proxy logs must include URLs and file extensions'
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains:
            - '.js'
            - '.jse'
        c-uri|contains:
            - 'update'
            - 'chrome'
            - 'firefox'
            - 'edge'
    filter:
        c-uri|contains:
            - 'google.com'
            - 'mozilla.org'
            - 'microsoft.com'
    condition: selection and not filter
falsepositives:
    - Legitimate browser update checks (rarely triggered via .js download directly)
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - socgholish
---
title: NetSupport RAT Execution via Client32
id: 2b745194-7a25-4b5d-8c4f-5d1c9b9e1d0a
description: Detects execution of NetSupport Manager client, often used in Okendo supply chain and other campaigns.
references:
    - https://otx.alienvault.com/pulse/6243829123472001/
author: Security Arsenal
date: 2026/06/22
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\client32.exe'
            - '\pcui.exe'
            - '\nco_ras.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use of NetSupport Manager
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - netsupport
---
title: Obfuscated JavaScript Loader Activity
description: Detects execution of heavily obfuscated JScript, common in SocGholish and SmartApeSG loaders.
references:
    - https://otx.alienvault.com/pulse/6243829123472001/
author: Security Arsenal
date: 2026/06/22
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli:
        CommandLine|contains:
            - 'eval('
            - 'String.fromCharCode'
            - 'WScript.Shell'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration scripts (rarely use high obfuscation)
level: medium
tags:
    - attack.defense_evasion
    - attack.t1027
    - obfuscation


kql
// Hunt for connections to known malicious hostnames from SOC Pulse data
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'trademark.iglesiaelarca.com',
    'content.garretttrails.org',
    'promo.summat10n.org',
    'billing.roofnrack.us',
    'devel.asurans.com',
    'storehouse.beautysupplysalonllc.com',
    'samples.addisgraphix.com',
    'api-app.uppercrafteroom.com',
    'api.wiggettiks.com',
    'api.wizzleticks.com'
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend Host = DeviceName
| summarize count() by RemoteUrl, Host
| order by count_ desc


powershell
# IOC Hunt Script for NetSupport RAT and Persistence Mechanisms
# Checks for specific registry keys and processes associated with Pulse malware families

Write-Host "[*] Scanning for NetSupport RAT Persistence Keys..." -ForegroundColor Cyan

$paths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

$maliciousKeys = @(
    "Client32",
    "pcui",
    "NetSupport Manager"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-Item $path | ForEach-Object {
            $_.Property | ForEach-Object {
                $prop = $_
                if ($maliciousKeys -like "*$prop*") {
                    Write-Host "[!] Suspicious persistence key found: $path\$prop" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "[*] Checking for Active Malicious Processes..." -ForegroundColor Cyan

$processList = @("client32.exe", "nco_ras.exe", "remcos.exe", "stealc.exe")

Get-Process | Where-Object { $processList -contains $_.ProcessName } | ForEach-Object {
    Write-Host "[!] Suspicious process detected: $($_.ProcessName) (PID: $($_.Id))" -ForegroundColor Red
    Write-Host "    Path: $($_.Path)"
}

Write-Host "[*] Hunt Complete."