Potential SocGholish Second Stage C2 DNS Query

Description

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Query · sigma

selection:
  Image|endswith: \wscript.exe
  QueryName|re: '[a-f0-9]{4,8}\.(?:[a-z0-9\-]+\.){2}[a-z0-9\-]+'
condition: selection

Known false positives

  • Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)
Raw source Potential SocGholish Second Stage C2 DNS Query · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Potential SocGholish Second Stage C2 DNS Query
id: 70761fe8-6aa2-4f80-98c1-a57049c08e66
status: test
description: Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic
references:
    - https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
    - https://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
    - https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
author: Dusty Miller
date: 2023-02-23
tags:
    - attack.command-and-control
    - attack.t1219.002
    - detection.emerging-threats
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        Image|endswith: '\wscript.exe'
        QueryName|re: '[a-f0-9]{4,8}\.(?:[a-z0-9\-]+\.){2}[a-z0-9\-]+'
    condition: selection
falsepositives:
    - Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.