SocGholish - Automated Reconnaissance Sequence (T1087)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•5

Detects rapid, automated execution of sequential reconnaissance commands (whoami, nltest, net, systeminfo) within a 1-minute window, indicative of potential SocGholish activity or similar automated reconnaissance.