Windows: SocGholish/FakeUpdates Execution via wscript Launching cmd or PowerShell

title: "Windows: SocGholish/FakeUpdates Execution via wscript Launching cmd or PowerShell"
id: 07a18885-03bc-45fd-b7b7-a4b132c93240
status: test
description: This rule identifies initial execution associated with FakeUpdates/SocGholish by matching a wscript.exe parent process that is launched from a browser-related download location containing a .zip and update .js file. It then looks for the child process to be cmd.exe or PowerShell, indicating command execution following the script launch. This behavior matters because scripted droppers commonly use wscript to run JavaScript from a temporary or download directory before spawning shell tooling for further payload actions. The detection relies on Windows process creation telemetry including parent image/command line and the child process image.
references:
  - https://twitter.com/th3_protoCOL/status/1536788652889497600
  - https://twitter.com/1ZRR4H/status/1537501582727778304
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/SocGholish/proc_creation_win_malware_socgholish_fakeupdates_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2022-06-16
modified: 2024-08-23
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \wscript.exe
    ParentCommandLine|contains|all:
      - \AppData\Local\Temp
      - .zip
      - update
      - .js
    ParentCommandLine|contains:
      - Chrome
      - Edge
      - Firefox
      - Opera
      - Brave
      - Vivaldi
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 97805087-93ab-4203-b5cb-287cda6aecaa
    type: derived