SocGholish Takedown, INC Ransomware Evolution & Supply Chain Injection: OTX Pulse Intelligence

---
title: Potential SocGholish Fake Browser Update
description: Detects potential execution of malicious JScript files delivered via fake browser update prompts, often associated with SocGholish and TA569.
author: Security Arsenal
date: 2026/06/20
references:
  - https://www.infoblox.com/blog/threat-intelligence/hot-take-operation-endgame-vs-socgholish/
tags:
  - attack.execution
  - attack.t1059.005
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - 'update'
      - 'chrome'
      - 'firefox'
      - 'edge'
  selection_ext:
    CommandLine|contains:
      - '.js'
      - '.jse'
  condition: all of selection_*
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: Suspicious PowerShell Execution Associated with ClickFix/SmartRAT
description: Detects PowerShell commands often used in ClickFix campaigns, including encoded commands and those mimicking system errors or updates.
author: Security Arsenal
date: 2026/06/20
references:
  - https://www.zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
  selection_keywords:
    CommandLine|contains:
      - 'captcha'
      - 'bsod'
      - 'update'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Potential Supply Chain Compromise via Okendo Widget
description: Detects network connections to suspicious domains associated with the Okendo Reviews supply chain attack.
author: Security Arsenal
date: 2026/06/20
references:
  - https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'wiggett'
      - 'wizzleticks'
  condition: selection
falsepositives:
  - None
level: critical

// Hunt for potential C2 communication and malicious downloads associated with provided IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "iglesiaelarca.com", "garretttrails.org", "summat10n.org", 
    "roofnrack.us", "asurans.com", "beautysupplysalonllc.com",
    "okendo.io", "wiggett", "wizzleticks",
    "crefisa.online", "windowsupdate-cdn.com",
    "incblog.su", "comples.biz", "dafkov.shop"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType

union (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where SHA256 in (
        "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c",
        "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"
    )
    or MD5 in (
        "297eb45f028d44d750297d2f932b9c91", "3c72e1f37f115b00c3ad6ed31bacfe8a",
        "6bf4d4c62b5138ace281ce3d08297787", "b17ccdb5531555e43f082d6e77c07227",
        "0d1f6685b4e284f92ef25c0f935b8cdc"
    )
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine,FolderPath, SHA256, MD5
)

<#
.SYNOPSIS
    Hunt script for IOCs related to SocGholish, INC Ransomware, and SmartRAT.
.DESCRIPTION
    This script checks the local system for the presence of suspicious files, processes, and registry keys.
.NOTES
    Author: Security Arsenal
    Date: 2026-06-20
#>

# Define File Hashes to search for
$SuspiciousSHA256 = @(
    "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c",
    "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"
)
$SuspiciousMD5 = @(
    "297eb45f028d44d750297d2f932b9c91", "3c72e1f37f115b00c3ad6ed31bacfe8a",
    "6bf4d4c62b5138ace281ce3d08297787", "b17ccdb5531555e43f082d6e77c07227",
    "0d1f6685b4e284f92ef25c0f935b8cdc"
)

# Scan for files matching the hashes
Write-Host "Scanning for suspicious files..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { 
    $_.Length -gt 0 -and (
        (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -in $SuspiciousSHA256 -or 
        (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash -in $SuspiciousMD5
    ) 
} | Select-Object FullName, LastWriteTime | Format-Table -AutoSize

# Scan for suspicious process command lines
Write-Host "Checking for suspicious processes..."
Get-WmiObject Win32_Process | Where-Object { 
    $_.CommandLine -match "FromBase64String" -or 
    $_.CommandLine -match "IEX " -or 
    $_.CommandLine -match "wiggett" -or 
    $_.CommandLine -match "wizzleticks"
} | Select-Object Name, ProcessId, CommandLine | Format-Table -AutoSize

# Check for suspicious persistence mechanisms (Registry)
Write-Host "Checking for suspicious registry entries..."
$Paths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-Item -Path $Path | Select-Object -ExpandProperty Property | ForEach-Object {
            $PropValue = (Get-ItemProperty -Path $Path -Name $_).$_
            if ($PropValue -match ".js" -or $PropValue -match ".jse" -or $PropValue -match "powershell.*IEX") {
                Write-Host "Suspicious registry entry found in $Path:"
                Write-Host "Name: $_ - Value: $PropValue"
            }
        }
    }
}
Write-Host "Hunt script execution complete."