---
title: Potential ClickFix Activity - Browser Spawning Terminal
id: 6e1a3c8d-9a2b-4c0d-8e1f-1b2c3d4e5f6a
description: Detects suspicious activity where a browser or communication application spawns a terminal or shell process, often indicative of ClickFix attacks leading to malware execution like Mach-O Man.
status: experimental
date: 2026/04/23
author: Security Arsenal
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
      - '/Google Chrome'
      - '/Firefox'
      - '/Telegram'
      - '/Microsoft Teams'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/curl'
      - '/osascript'
  condition: selection
falsepositives:
  - Legitimate developer workflows launching scripts from browser downloads
level: high
---
title: VS Code Task Execution Suspicious Command
id: 7b2c4d9e-0b3c-5d1e-9f2a-2c3d4e5f6a7b
description: Detects execution of potentially malicious commands via VS Code tasks, a technique used by Void Dokkaebi to propagate BeaverTail and DEV#POPPER RAT.
status: experimental
date: 2026/04/23
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: 'Microsoft VS Code'
    Image|endswith:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'wscript.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'git config'
  condition: selection
falsepositives:
  - Legitimate build scripts or extensions
level: medium
---
title: TwizAdmin C2 Connection FastAPI Port
id: 8c3d5e0f-1c4d-6e2f-0a3b-3d4e5f6a7b8c
description: Detects outbound connections to port 1337, associated with the TwizAdmin malware C2 panel.
status: experimental
date: 2026/04/23
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 1337
    Initiated: 'true'
  filter:
    DestinationIp|contains:
      - '127.0.0.1'
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate local development on port 1337
level: high

// Hunt for Void Dokkaebi and TwizAdmin IOCs
let IOCs = dynamic([
    "103.241.66.238", "31.31.198.206", "166.88.4.2", "85.239.62.36", 
    "23.27.20.143", "23.27.202.27", "23.27.120.142", "154.91.0.196",
    "livemicrosft.com", "fanonlyatn.xyz"
]);
DeviceNetworkEvents
| where RemoteIP in IOCs or RemoteUrl in IOCs
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

<#
    TwizAdmin & Void Dokkaebi IOC Hunt
    Checks for process connections to known C2 IPs and suspicious file hashes in temp paths.
#>

$MaliciousIPs = @(
    "103.241.66.238", "31.31.198.206", "166.88.4.2", "85.239.62.36", 
    "23.27.20.143", "23.27.202.27", "23.27.120.142", "154.91.0.196",
    "198.105.127.210", "83.168.68.219"
)

Write-Host "Checking for active network connections to C2 infrastructure..." -ForegroundColor Cyan

# Get established TCP connections
$netStat = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($ip in $MaliciousIPs) {
    $hits = $netStat | Where-Object { $_.RemoteAddress -eq $ip }
    if ($hits) {
        Write-Host "[!] ALERT: Connection found to malicious IP: $ip" -ForegroundColor Red
        $hits | ForEach-Object { 
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "    PID: $($_.OwningProcess) | Process: $($proc.ProcessName) | Path: $($proc.Path)"
        }
    }
}

Write-Host "Checking for suspicious VS Code task execution..." -ForegroundColor Cyan
$vscodeLog = "$env:APPDATA\Code\logs\*
*.log"
if (Test-Path $vscodeLog) {
    Select-String -Path $vscodeLog -Pattern "curl|Invoke-WebRequest|DownloadString" -Context 2,2 | Select-Object -Last 20
}


# Response Priorities

*   **Immediate**:
    *   Block all IOCs (Domains `fanonlyatn.xyz`, `livemicrosft.com`; IPs `103.241.66.238`, `166.88.4.2`, etc.) at perimeter firewalls and proxies.
    *   Isolate any endpoints with detected connections to port 1337 or the listed Void Dokkaebi IP ranges.
    *   Scan for the listed SHA256 hashes; quarantine any matches.

*   **24 Hours**:
    *   Initiate credential resets for developers and finance staff who may have been exposed to credential stealers (TwizAdmin/Mach-O Man).
    *   Audit Git repositories for unauthorized changes to `.vscode/tasks.` and recent pushes from unknown developers.

*   **1 Week**:
    *   Implement strict application allowlisting for terminal/bash execution on macOS devices to mitigate ClickFix.
    *   Enforce "Review and Approval" workflows for all external VS Code extensions and cloned Git repositories.
    *   Conduct security awareness training focused on identifying fake job interview lures and fake meeting invitations.