Sigma rule: Potential SocGholish Second Stage C2 DNS Query

Rule

Title

Potential SocGholish Second Stage C2 DNS Query

Status

test

Level

high

Author

Dusty Miller

Date

2023-02-23

File

rules-emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Log source

product

windows

category

dns_query

Detection

selection:
    Image|endswith: '\wscript.exe'
    QueryName|re: '[a-f0-9]{4,8}\.(?:[a-z0-9\-]+\.){2}[a-z0-9\-]+'
condition: selection

False positives (as the rule lists them)

• Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)

Tags

• attack.command-and-control
• attack.t1219.002
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1219.002

References

• https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
• https://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
• https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml