title: Potential Malicious Okendo Widget or Supply Chain JS Injection
id: 8d1f4a2b-6c3e-4a5d-9b1a-2c3d4e5f6a7b
description: Detects potential connection to malicious domains associated with the Okendo supply chain attack or SocGholish fake updates.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack
    - https://www.infoblox.com/blog/threat-intelligence/hot-take-operation-endgame-vs-socgholish/
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: proxy
detection:
    selection:
        c-hostname|contains:
            - 'wigetticks.com'
            - 'wizzleticks.com'
            - 'iglesiaelarca.com'
            - 'garretttrails.org'
            - 'roofnrack.us'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: NetSupport RAT Execution Activity
id: 9e2g5b3c-7d4f-5b6e-0c2b-3d4e5f6a7b8c
description: Detects execution of NetSupport Manager client (client32.exe), frequently used in recent supply chain and fake update campaigns including Okendo and SocGholish.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6674a1c2d9f8b
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\client32.exe'
            - '\client64.exe'
        OriginalFileName:
            - 'client32.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use (should be filtered by target list)
level: high
---
title: Suspicious PowerShell Download via Fake Update Patterns
id: 0f1h2i3j-4k5l-6m7n-8o9p-0q1r2s3t4u5v
description: Detects PowerShell commands attempting to download content mimicking browser updates or utilizing obfuscation seen in SocGholish and SmartApeSG campaigns.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6674a1c2d9f8b
tags:
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
        CommandLine|contains:
            - 'downloadstring'
            - 'iex'
        CommandLine|contains:
            - 'update'
            - 'chrome'
            - 'browser'
    condition: selection
falsepositives:
    - System update scripts
level: medium

// Hunt for malicious C2 hostnames from Okendo and SocGholish pulses
DeviceNetworkEvents
| where RemoteUrl in~ (
    "trademark.iglesiaelarca.com", 
    "content.garretttrails.org", 
    "promo.summat10n.org", 
    "billing.roofnrack.us", 
    "api.wigetticks.com", 
    "api.wizzleticks.com"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| extend Tactic = "C2 Communication"
;
// Hunt for NetSupport RAT and Remcos processes
DeviceProcessEvents 
| where FileName in~ ("client32.exe", "client64.exe", "Remcos.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend Tactic = "Execution"

# IOC Hunt for Okendo/SocGholish C2s and NetSupport RAT
$MaliciousHosts = @(
    "wigetticks.com",
    "wizzleticks.com",
    "iglesiaelarca.com",
    "roofnrack.us"
)

Write-Host "[+] Checking for active network connections to malicious IOCs..."
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach $Conn in $Connections {
    try {
        $RemoteAddress = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress)
        if ($MaliciousHosts -icontains $RemoteAddress.HostName) {
            Write-Host "[!] Suspicious connection found: $($RemoteAddress.HostName) on PID $($Conn.OwningProcess)" -ForegroundColor Red
            Get-Process -Id $Conn.OwningProcess | Select-Object ProcessName, Path
        }
    } catch {
        # Ignore DNS resolution failures for local IPs
    }
}

Write-Host "[+] Scanning for NetSupport RAT processes..."
$RATProcesses = Get-Process | Where-Object { $_.ProcessName -like "client32.exe" -or $_.ProcessName -like "client64.exe" }

if ($RATProcesses) {
    Write-Host "[!] NetSupport RAT process detected!" -ForegroundColor Red
    $RATProcesses | Format-List *
} else {
    Write-Host "[-] No NetSupport RAT processes found."
}


# Response Priorities

*   **Immediate**:
    *   Block all hostnames and domains listed in the IOC Analysis section at the perimeter firewall and proxy.
    *   Kill any processes matching `client32.exe`, `Remcos.exe`, or suspicious PowerShell download scripts.
    *   Isolate endpoints showing signs of connectivity to the Middle Eastern C2 infrastructure range if outside expected business geography.

*   **24h**:
    *   Perform credential resets for users who accessed the compromised Okendo widget domains or interacted with the SocGholish fake update prompts.
    *   Hunt for the persistence mechanisms (Scheduled Tasks/Registry keys) associated with NetSupport RAT and Remcos on endpoints identified as having suspicious process execution.

*   **1 Week**:
    *   Conduct a review of all third-party JavaScript widgets and supply chain dependencies. Enforce Subresource Integrity (SRI) where possible.
    *   Update EDR policies to specifically flag unsigned or loosely signed executables originating from browser child processes (typical ClickFix behavior).
    *   Review network segmentation for OT and Energy sectors to limit lateral movement from IoT botnets identified in the Middle East pulse.