SocGholish Takedown, Okendo Supply Chain, and Middle East C2 Surge: OTX Pulse Analysis

---
title: Potential SocGholish Fake Browser Update Execution
id: 8f452c62-8f1a-4884-8e3b-123456789012
description: Detects execution of JScript or VBScript initiated by a browser, typical of Fake Browser Update campaigns like SocGholish.
status: experimental
date: 2026/06/23
author: Security Arsenal
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \chrome.exe
      - \firefox.exe
      - \msedge.exe
      - \opera.exe
    Image|endswith:
      - \wscript.exe
      - \cscript.exe
      - \mshta.exe
    CommandLine|contains:
      - '.js'
      - '.vbs'
  condition: selection
falsepositives:
  - Legitimate web-based administration tools
level: high
---
title: Okendo Reviews Malicious JS Injection C2 Traffic
id: b391d4e5-6a7b-4c8d-9e0f-987654321098
description: Detects network connections to known malicious C2 domains associated with the Okendo Reviews supply chain attack.
status: experimental
date: 2026/06/23
author: Security Arsenal
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|endswith:
      - wigletticks.com
      - wizzleticks.com
  condition: selection
falsepositives:
  - Unknown
level: critical
---
title: Suspicious AsyncRAT or NetSupport Process Activity
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects execution patterns consistent with AsyncRAT or NetSupport RAT loaders and C2 beacons observed in Middle East campaigns.
status: experimental
date: 2026/06/23
author: Security Arsenal
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \cmd.exe
    CommandLine|contains:
      - 'DownloadString'
      - 'iex'
      - 'Invoke-Expression'
    CommandLine|contains:
      - 'asyncrat'
      - 'netsupport'
      - 'remcos'
  condition: selection
falsepositives:
  - Legitimate admin scripting
level: high

// Hunt for SocGholish related process execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('chrome.exe', 'firefox.exe', 'msedge.exe')
| where FileName in~ ('wscript.exe', 'cscript.exe', 'mshta.exe')
| where ProcessCommandLine has '.js' or ProcessCommandLine has '.vbs'
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

// Hunt for Okendo C2 Network Traffic
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ('wigletticks.com', 'wizzleticks.com')
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName

// Hunt for RAT C2 connections (AsyncRAT/NetSupport commonly use specific ports)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (80, 443, 8080)
| where InitiatingProcessFileName in~ ('client32.exe', 'client.exe', 'Remcos.exe', 'python.exe') // Common RAT binaries
| summarize count() by DeviceName, RemoteUrl, InitiatingProcessFileName

<#
.SYNOPSIS
    Hunts for artifacts associated with OTX Pulses: Okendo (SmartApeSG), SocGholish, and Middle East RATs.
.DESCRIPTION
    Checks for running processes of NetSupport/Remcos/AsyncRAT and suspicious scheduled tasks.
#>

Write-Host "[+] Starting Hunt for OTX Pulse Indicators..." -ForegroundColor Cyan

# 1. Check for Malicious Processes (RATs)
$MaliciousProcesses = @("client32.exe", "Remcos.exe", "AsyncRAT.exe", "NetSupport Manager")
$RunningProcesses = Get-Process | Where-Object { $MaliciousProcesses -contains $_.ProcessName }

if ($RunningProcesses) {
    Write-Host "[!] ALERT: Found suspicious RAT processes running:" -ForegroundColor Red
    $RunningProcesses | Select-Object ProcessName, Id, Path
} else {
    Write-Host "[-] No malicious RAT processes found." -ForegroundColor Green
}

# 2. Check for Scheduled Tasks (Common Persistence)
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -like "*Update*" -or 
    $_.TaskName -like "*Chrome*" -or 
    $_.TaskName -like "*Flash*" -or
    $_.Actions.Execute -like "*wscript*" -or
    $_.Actions.Execute -like "*powershell*"
}

if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Found suspicious scheduled tasks:" -ForegroundColor Yellow
    $SuspiciousTasks | Select-Object TaskName, State, Actions
} else {
    Write-Host "[-] No suspicious scheduled tasks found." -ForegroundColor Green
}

# 3. Check Browser Cache for Okendo/SocGholish domains
$Domains = @("wigletticks.com", "wizzleticks.com", "trademark.iglesiaelarca.com")
Write-Host "[+] Checking DNS Cache for malicious domains..."
$DnsCache = Get-DnsClientCache | Where-Object { $Domains -contains $_.Entry }

if ($DnsCache) {
    Write-Host "[!] ALERT: Found DNS cache entries for malicious domains:" -ForegroundColor Red
    $DnsCache
} else {
    Write-Host "[-] No malicious DNS cache entries found." -ForegroundColor Green
}

Write-Host "[+] Hunt complete."