Malware2023

Potential SocGholish Second Stage C2 DNS Query

1Rules

3References

1Folders

2023-02-23Latest

Summary

Potential SocGholish Second Stage C2 DNS Query is tracked here as a malware family or toolset with 1 Sigma detection spanning 2023. Coverage centers on windows / dns_query.

Related Detections

Search this threat

Emerging Threathightest

Potential SocGholish Second Stage C2 DNS Query

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

WindowsDNS Query

TA0011 · Command and ControlT1219.002 · Remote Desktop Softwaredetection.emerging-threats

Dusty MillerThu Feb 232023

References