SocGholish
Software · ATTACK:enterprise:S1124
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1124",
"title": "SocGholish",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1124",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5911d2ca-64f6-49b3-b94f-29b5d185085c",
"external_id": "S1124",
"domain": "enterprise",
"created": "2024-03-22T19:21:30.424Z",
"modified": "2024-04-06T00:08:07.956Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "FakeUpdates"
},
{
"source_name": "SocGholish-update",
"url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
},
{
"source_name": "SentinelOne SocGholish Infrastructure November 2022",
"url": "https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"
},
{
"source_name": "Red Canary SocGholish March 2024",
"url": "https://redcanary.com/threat-detection-report/threats/socgholish/"
},
{
"source_name": "Secureworks Gold Prelude Profile",
"url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a28d78a-d11b-466a-977f-19d2e88c1952
SocGholish-update · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35d76097-4eee-4b37-8b5c-05eec6ab7911
Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36986111-c0c0-40d0-8d88-3b59e655c2d1
SocGholish-updateATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--446e3bf2-9a37-4d22-a7ca-ede547e5e16e
Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44e55496-b39d-45b7-96b9-1840d2492a14
SentinelOne SocGholish Infrastructure November 2022ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--499af4be-5b6b-40b2-8df7-f41011ed1f4d
SocGholish-update · Red Canary SocGholish March 2024ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69772984-96a1-47f1-ac27-08f85ff492e2
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71d14fd4-c393-4dd9-9ae3-3970295ac4a5
SocGholish-updateATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80c27fda-8e6c-49f4-a236-5ac424fd0849
SocGholish-updateATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c5c3632-2327-4ff2-ada8-25036a19b85a
SocGholish-update · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e724de0-431e-4db8-b118-979405ede39a
SocGholish-updateATTACK:enterprise:G1020 → uses → ATTACK:enterprise:S1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--944f957c-f44b-4635-9635-985aedbb5d17
SocGholish-update · Microsoft Ransomware as a Service · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a63bc24e-2b10-46bc-a9a5-992701755923
SocGholish-updateATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b78b92b1-deab-4ac1-b1c5-ceb6fa28810a
Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c052113d-2552-48fc-8deb-d6965d85f547
Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0fdf36c-02e5-4100-b0f2-a1fb28fdd674
Red Canary SocGholish March 2024ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3b20c80-7b6e-4a0a-8e69-f2d948cadd0e
Red Canary SocGholish March 2024ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f68dea79-cd44-4791-bee1-e0650868bd28
SentinelOne SocGholish Infrastructure November 2022ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--faf41333-e316-45ea-8f52-faa98b4683d5
SocGholish-update · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff138201-bc3e-4a79-acbf-17b18e50d0fc
Red Canary SocGholish March 2024 · Secureworks Gold Prelude Profile