Potential SocGholish Second Stage C2 DNS Query

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•2•0•36

Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic. This pattern often involves a hexadecimal string followed by two subdomains and a top-level domain.