SocGholish - Domain Shadowing Beaconing (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•5•0•9

Correlates JS payload execution with immediate network requests to high-reputation but compromised shadowed domains used for traffic proxying. Specifically, this rule detects network connections initiated by 'wscript.exe' to known SocGholish domain shadowing infrastructure.