SocGholish (FakeUpdates) — JavaScript Loader & Access Broker

Looks for: wscript.exe/cscript.exe running a .js from Downloads/Temp. Accomplishes: catches the SocGholish loader at execution — the flagship signal.

// HUNT: SocGholish JS loader (wscript runs .js from a browser-download path)
// MITRE: T1189, T1059.007 | CONF: high  FP: low  COST: low
// FP NOTES: legit .js automation rarely runs from Downloads/Temp via wscript
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.js("|\s|$)/i
| CommandLine=/\\(Downloads|Temp|AppData\\Local\\Temp)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: host-profiling binaries whose parent is wscript.exe. Accomplishes: catches SocGholish's recon stage — a script host has no business spawning nltest/systeminfo.

// HUNT: SocGholish host profiling (recon parented by wscript)
// MITRE: T1087, T1016, T1082 | CONF: high  FP: low  COST: low
// FP NOTES: script hosts rarely spawn nltest/systeminfo/whoami in normal use
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(wscript|cscript)\.exe$/i
| FileName=/^(whoami|nltest|systeminfo|net|net1|ipconfig|hostname|qwinsta|wmic)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: outbound SMB (445) to an external host shortly after a Q1/Q2 hit (WebDAV/SCF NTLM coercion). FP: cloud SMB — exclude sanctioned CIDRs; correlate to same host.

// HUNT: SocGholish WebDAV/SCF NTLM coercion (outbound SMB to external host)
// MITRE: T1187 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude RFC1918 + sanctioned cloud-SMB; correlate to a same-host Q1/Q2 hit
#event_simpleName=NetworkConnectIP4
| RemotePort=445
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: python.exe parented by wscript/cscript/mshta, or running a script from a user-temp path. Accomplishes: catches the RansomHub-affiliate Python backdoor.

// HUNT: SocGholish Python backdoor
// MITRE: T1059.006, T1071.001 | CONF: med-high  FP: low-med  COST: low
// TUNING: legit python is common; require a script-host parent or temp-path script
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^python[0-9.]*\.exe$/i
| (ParentBaseFileName=/^(wscript|cscript|mshta)\.exe$/i or CommandLine=/\\(Temp|AppData\\Local\\Temp)\\.+\.py/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: wscript/cscript initiating outbound web connections. Accomplishes: surfaces loader C2 beaconing. FP: some logon/admin scripts — correlate with Q1 + external destination.

// HUNT: SocGholish loader C2 beacon (script host outbound web)
// MITRE: T1071.001 | CONF: medium  FP: medium  COST: medium
// TUNING: exclude internal/admin-script destinations; correlate to Q1 on same aid
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(wscript|cscript)\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: shadow-copy deletion / RMM install / mass file activity on a host with a recent SocGholish hit. Accomplishes: catches the escalation toward ransomware. FP: correlate strictly with a same-host Q1/Q2.

// HUNT: Ransomware precursor after SocGholish (recovery inhibition / RMM)
// MITRE: T1490, T1219 | CONF: medium  FP: medium  COST: low
// TUNING: scope to hosts with a recent Q1/Q2 hit; allow-list sanctioned RMM/backup admin
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/vssadmin(\.exe)?\s+delete\s+shadows|wmic\s+shadowcopy\s+delete|(screenconnect|anydesk|atera|splashtop|tightvnc)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)