Fox Tempest MSaaS, UAT-8616 SD-WAN Attacks, & macOS ClickFix: Enterprise Detection Pack

title: macOS ClickFix - Suspicious Osascript Network Connection
id: 509c3e8e-0ee4-4585-9776-9b6c7b4c9f21
description: Detects macOS processes spawned by osascript making network connections, indicative of the ClickFix campaign infostealer behavior.
status: experimental
date: 2026/05/21
author: Security Arsenal
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    InitiatorProcessName|endswith: 'osascript'
    DestinationPortRange:
      - 80
      - 443
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: high
tags:
  - attack.execution
  - attack.t1059.002
---
title: UAT-8616 - SD-WAN Webshell Activity via Java Process
id: 7b8a1c2d-3e4f-4a5b-8c9d-1e2f3a4b5c6d
description: Detects suspicious child processes (cmd.exe, powershell.exe, bash) spawned by the Java/Tomcat service often running Cisco SD-WAN Manager, indicative of webshell exploitation.
status: experimental
date: 2026/05/21
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: 
      - 'java.exe'
      - 'javaw.exe'
  selection_child:
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative tasks by IT
level: critical
tags:
  - attack.initial_access
  - attack.t1190
---
title: Fox Tempest - Signed XMRig Execution
id: 9c0d1e2f-3a4b-4c5d-6e7f-8a9b0c1d2e3f
description: Detects the execution of XMRig or similar miners, potentially signed or utilized by UAT-8616 after exploiting network devices.
status: experimental
date: 2026/05/21
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: 'xmrig'
  condition: selection
falsepositives:
  - Authorized testing or legitimate mining operations
level: high
tags:
  - attack.impact
  - attack.t1496


kql// Hunt for ClickFix and UAT-8616 Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("176.65.139.31", "172.94.9.250") 
   or RemoteUrl has_any ("bull-run.fun", "spot-wave.fun", "signspace.cloud")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend ThreatActivity = case(
    RemoteIP == "176.65.139.31", "UAT-8616 SD-WAN C2",
    RemoteIP == "172.94.9.250" or RemoteUrl has_any ("bull-run", "spot-wave"), "ClickFix Campaign",
    RemoteUrl has "signspace", "Fox Tempest Infrastructure",
    "Unknown Threat Traffic")


powershell# IOC Hunter for UAT-8616 and Fox Tempest Payloads
# Checks system for specific file hashes mentioned in OTX pulses

$targetHashes = @(
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", # XenShell/Webshell
    "e12285f507c847b986233991b86b22e3", # macOS ClickFix Component
    "7e6d9dac619c04ae1b3c8c0906123e752ed66d63", # Fox Tempest Signed Malware
    "11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326"  # Signed Payload
)

Write-Host "[+] Scanning for UAT-8616 and Fox Tempest IOCs..." -ForegroundColor Cyan

$searchPaths = @("C:\", "C:\ProgramData", "C:\Users")

foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Write-Host "[+] Scanning $path..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { !$_.PSIsContainer } | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($targetHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                Write-Host "    Hash: $hash"
            }
        }
    }
}

# Check Network Connections for Known C2 IPs
$targetIPs = @("176.65.139.31", "172.94.9.250")
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($ip in $targetIPs) {
    $match = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($match) {
        Write-Host "[!] ACTIVE C2 CONNECTION DETECTED to $ip on PID: $($match.OwningProcess)" -ForegroundColor Red
        Get-Process -Id $match.OwningProcess | Select-Object ProcessName, Path
    }
}