SocGholish TDS Takedown: Defending Against Malicious Traffic Distribution Systems

---
title: Suspicious Browser Update JavaScript Download
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects downloads of JavaScript files commonly associated with fake browser update campaigns like SocGholish. SocGholish typically drops JS files with update-related naming patterns.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
    TargetFilename|endswith:
      - '.js'
    TargetFilename|contains:
      - 'update'
      - 'chrome'
      - 'firefox'
      - 'browser'
      - 'extension'
  condition: selection
falsepositives:
  - Legitimate browser extension installations by IT
level: high
---
title: PowerShell Execution from JavaScript Downloader
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects PowerShell commands spawned by JavaScript processes, a common pattern in SocGholish infections where the JS dropper executes PowerShell to establish persistence.
references:
  - https://attack.mitre.org/techniques/T1059.001/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.user_execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\node.exe'
      - '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'Invoke-Expression'
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: Suspicious TDS Redirect Patterns in Web Logs
id: c3d4e5f6-7890-12ab-cdef-3456789012cd
status: experimental
description: Detects potential TDS redirect patterns in web server access logs characteristic of SocGholish campaign infrastructure, including encoded redirect parameters and suspicious referrer chains.
references:
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  - iis
  - nginx
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'redirect='
      - 'dest='
      - 'target='
      - 'go='
  selection_params:
    cs-uri-query|contains:
      - '%3F'
      - '%26'
      - '%3D'
  selection_ua:
    cs-user-agent|contains:
      - 'bot'
      - 'crawler'
    cs-uri-query|contains:
      - 'human'
      - 'verify'
  condition: 1 of selection*
falsepositives:
  - Legitimate marketing redirect services
  - Load balancer health checks
level: medium

// Hunt for SocGholish TDS-related network patterns and suspicious file downloads
let SuspiciousTDSDomains = dynamic(['traffic-direction', 'redirection-service', 'cdn-redirect', 'stat-counter', 'analytics-redirect']);
let FakeUpdatePatterns = dynamic(['chrome_update', 'firefox_update', 'browser_update', 'extension_update', 'software_update']);
// DeviceProcessEvents for suspicious JS spawning PowerShell
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ('wscript.exe', 'cscript.exe', 'node.exe', 'mshta.exe', 'java.exe')
| where FileName =~ 'powershell.exe' or FileName =~ 'pwsh.exe'
| where ProcessCommandLine has_any ('DownloadString', 'IEX', 'Invoke-Expression', 'FromBase64String', 'WebClient')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| join kind=inner (
    DeviceFileEvents
    | where Timestamp >= ago(7d)
    | where FolderPath has_any (@'\AppData\Local\Temp\', @'\Downloads\')
    | where FileName endswith '.js'
    | where FileName has_any (FakeUpdatePatterns)
) on DeviceName, Timestamp
| distinct Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
// DeviceNetworkEvents for TDS connections
| union (DeviceNetworkEvents
    | where Timestamp >= ago(7d)
    | where RemoteUrl has_any (SuspiciousTDSDomains)
    | where RemotePort in (80, 443)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName)
| order by Timestamp desc

-- Hunt for SocGholish indicators including suspicious JS files, 
-- PowerShell execution chains, and TDS-related network connections
-- Check for suspicious JavaScript files in common download/temp locations
SELECT 
    FullPath, 
    Size, 
    Mtime, 
    Btime,
    hash(path=FullPath) AS Hash
FROM glob(globs="/Users/*/Downloads/*.js", "/Users/*/Library/Caches/**/*.js", 
"C:/Users/*/Downloads/*.js", "C:/Users/*/AppData/Local/Temp/*.js")
WHERE FullPath =~ "(update|chrome|firefox|browser|extension)"
   AND Size < 500000
   AND Mtime > now() - 30 * 24 * 60 * 60

-- Hunt for PowerShell processes spawned from suspicious parent processes
SELECT 
    Pid, 
    Ppid, 
    Name, 
    CommandLine, 
    Exe, 
    Username, 
    StartTime
FROM pslist()
WHERE Name =~ "powershell" OR Name =~ "pwsh"
   AND Ppid IN (
       SELECT Pid 
       FROM pslist() 
       WHERE Name =~ "(wscript|cscript|node|mshta|java)"
   )
   AND CommandLine =~ "(DownloadString|IEX|Invoke-Expression|WebClient)"

-- Check network connections for TDS-related indicators
SELECT 
    Fd, 
    Family, 
    Type, 
    State, 
    RemoteAddress, 
    RemotePort
FROM netstat()
WHERE RemotePort IN (80, 443, 8080)
   AND RemoteAddress =~ "(\.\d{1,3}\.\d{1,3}\.\d{1,3})"
   AND State =~ "ESTABLISHED"
   AND RemoteAddress != "127.0.0.1"
   AND RemoteAddress != "::1"

# SocGholish Remediation and Detection Script
# Run as Administrator with elevated privileges

Write-Host "[+] Starting SocGholish Detection and Remediation Script..." -ForegroundColor Cyan

# Define suspicious patterns and locations
$suspiciousPatterns = @("update", "chrome", "firefox", "browser", "extension")
$tempPaths = @(
    "$env:LOCALAPPDATA\Temp",
    "$env:USERPROFILE\Downloads",
    "$env:APPDATA\Local\Temp"
)

# Function to calculate file hash
function Get-FileHashQuick {
    param($Path)
    try {
        $hash = Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction Stop
        return $hash.Hash
    } catch {
        return "Unable to calculate"
    }
}

# Scan for suspicious JavaScript files
Write-Host "\n[*] Scanning for suspicious JavaScript files..." -ForegroundColor Yellow
$foundJS = @()

foreach ($path in $tempPaths) {
    if (Test-Path $path) {
        $files = Get-ChildItem -Path $path -Filter "*.js" -Recurse -ErrorAction SilentlyContinue
        foreach ($file in $files) {
            $matchPattern = $false
            foreach ($pattern in $suspiciousPatterns) {
                if ($file.Name -like "*$pattern*") {
                    $matchPattern = $true
                    break
                }
            }
            if ($matchPattern) {
                $hash = Get-FileHashQuick -Path $file.FullName
                $foundJS += [PSCustomObject]@{
                    Path = $file.FullName
                    Name = $file.Name
                    Size = $file.Length
                    Hash = $hash
                    Created = $file.CreationTime
                    Modified = $file.LastWriteTime
                }
            }
        }
    }
}

if ($foundJS.Count -gt 0) {
    Write-Host "\n[!] FOUND SUSPICIOUS JAVASCRIPT FILES:" -ForegroundColor Red
    $foundJS | Format-Table -AutoSize
    
    $response = Read-Host "\nDo you want to quarantine these files? (Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        $quarantinePath = "$env:ProgramData\SocGholish_Quarantine"
        if (!(Test-Path $quarantinePath)) {
            New-Item -Path $quarantinePath -ItemType Directory -Force | Out-Null
        }
        foreach ($file in $foundJS) {
            try {
                $newName = "$($file.Name)_$(Get-Date -Format 'yyyyMMddHHmmss')"
                Move-Item -Path $file.Path -Destination "$quarantinePath\$newName" -Force
                Write-Host "[+] Quarantined: $($file.Name)" -ForegroundColor Green
            } catch {
                Write-Host "[-] Failed to quarantine: $($file.Name) - $_" -ForegroundColor Red
            }
        }
    }
} else {
    Write-Host "[+] No suspicious JavaScript files found." -ForegroundColor Green
}

# Check for suspicious scheduled tasks (common SocGholish persistence)
Write-Host "\n[*] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.TaskName -match "(update|chrome|firefox|browser)" -and 
    $_.State -eq "Ready"
}

if ($suspiciousTasks) {
    Write-Host "\n[!] FOUND SUSPICIOUS SCHEDULED TASKS:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, State, LastRunTime | Format-Table -AutoSize
    
    $response = Read-Host "\nDo you want to disable these tasks? (Y/N)"
    if ($response -eq 'Y' -or $response -eq 'y') {
        foreach ($task in $suspiciousTasks) {
            try {
                Disable-ScheduledTask -TaskName $task.TaskName -ErrorAction Stop
                Write-Host "[+] Disabled task: $($task.TaskName)" -ForegroundColor Green
            } catch {
                Write-Host "[-] Failed to disable task: $($task.TaskName)" -ForegroundColor Red
            }
        }
    }
} else {
    Write-Host "[+] No suspicious scheduled tasks found." -ForegroundColor Green
}

# Block known TDS domains in hosts file
Write-Host "\n[*] Checking hosts file for TDS blocks..." -ForegroundColor Yellow
$hostsFile = "$env:SystemRoot\System32\drivers\etc\hosts"
$knownTDS = @("# Block common TDS infrastructure added by SocGholish remediation")

$hostsContent = Get-Content $hostsFile -ErrorAction SilentlyContinue
$existingBlocks = $hostsContent | Where-Object { $_ -match "SocGholish remediation" }

if (-not $existingBlocks) {
    Write-Host "[+] No existing SocGholish blocks found." -ForegroundColor Green
} else {
    Write-Host "[*] Existing SocGholish blocks present in hosts file." -ForegroundColor Yellow
}

Write-Host "\n[+] Remediation scan complete." -ForegroundColor Cyan
Write-Host "\n[*] RECOMMENDATION:" -ForegroundColor Yellow
Write-Host "    1. Review quarantined files and escalate to security team for analysis"
Write-Host "    2. Execute full AV/EDR scan immediately"
Write-Host "    3. Review web server logs for signs of compromise if applicable"
Write-Host "    4. Rotate credentials if infection is confirmed"