Emerging Threathightest

FakeUpdates/SocGholish Activity

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

kostastsaleCreated Thu Jun 16Updated Fri Aug 2397805087-93ab-4203-b5cb-287cda6aecaa2022

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\wscript.exe'
        ParentCommandLine|contains|all:
            - '\AppData\Local\Temp'
            - '.zip'
            - 'update'
            - '.js'
        ParentCommandLine|contains:
            - 'Chrome'
            - 'Edge'
            - 'Firefox'
            - 'Opera'
            - 'Brave' # Not seen in campaigns
            - 'Vivaldi' # Not seen in campaigns
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection