title: Potential macOS ClickFix Terminal Execution
id: 6e9b03c4-1f0a-4c5b-9b2c-1a2b3c4d5e6f
description: Detects suspicious terminal commands often used in ClickFix attacks where a curl/wget command is piped to bash or executed via osascript, indicative of Mach-O Man or AppleScript stealer installation.
status: experimental
date: 2026/05/22
author: Security Arsenal
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/bin/bash'
      - '/bin/sh'
      - '/bin/zsh'
      - '/usr/bin/osascript'
    CommandLine|contains:
      - 'curl '
      - 'wget '
  condition: selection
falsepositives:
  - Legitimate software installation scripts
level: high
tags:
  - attack.execution
  - attack.t1059.004
---
title: VS Code Suspicious Task Execution
id: 7a0d14e5-2g1b-5d6c-0c3d-2b3c4d5e6f7g
description: Detects execution of code via VS Code internal terminals or tasks, a vector used by Void Dokkaebi to propagate DEV#POPPER RAT and BeaverTail.
status: experimental
date: 2026/05/21
author: Security Arsenal
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    ParentImage|contains: 'Visual Studio Code'
    Image|endswith:
      - '/node'
      - '/python'
      - '/bin/bash'
  condition: selection
falsepositives:
  - Developer debugging activities
level: medium
tags:
  - attack.initial_access
  - attack.t1192
---
title: macOS Credential Harvesting via AppleScript
id: 8b1e25f6-3h2c-6e7d-1d4e-3c4d5e6f7g8h
description: Detects AppleScript accessing browser cookie or credential directories, behavior associated with the AppleScript infostealer campaign.
status: experimental
date: 2026/05/21
author: Security Arsenal
logsource:
  product: macos
  category: file_access
detection:
  selection:
    Image|endswith: '/usr/bin/osascript'
    TargetFilename|contains:
      - '/Library/Application Support/Google/Chrome/'
      - '/Library/Safari/'
      - '/Library/Cookies/'
  condition: selection
falsepositives:
  - Legitimate automation scripts
level: high
tags:
  - attack.credential_access
  - attack.t1555.001

// Hunt for network connections to known malicious domains from ClickFix campaigns
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("livemicrosft.com", "bull-run.fun", "spot-wave.fun", "gen.detect.by.nscloudsandbox.tr")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, Action
| extend FullURL = strcat("https://", RemoteUrl, "/")
| order by Timestamp desc

#!/bin/bash
# IOC Hunt for Lazarus/WageMole Indicators
# Checks for active network connections to suspicious domains

echo "Checking for active connections to known C2 domains..."

DOMAINS=("livemicrosft.com" "bull-run.fun" "spot-wave.fun")

for domain in "${DOMAINS[@]}"; do
    if nslookup "$domain" | grep -q "Address"; then
        echo "[WARNING] DNS resolution successful for malicious domain: $domain"
    fi
done

echo "Checking for common malware persistence locations..."

# Check for common VS Code exploit locations
echo "Scanning VS Code workspace storage for suspicious tasks..."
if [ -d "$HOME/.config/Code/User/workspaceStorage" ]; then
    find "$HOME/.config/Code/User/workspaceStorage" -name "*." -exec grep -l "node.*beaver" {} \; 2>/dev/null && echo "[ALERT] Potential BeaverTail payload found in VS Code config."
fi

# Check for recent suspicious downloads in common directories
echo "Scanning Downloads for recent binaries..."
find ~/Downloads -name ".sh" -o -name ".command" -mtime -2 2>/dev/null | while read file; do
    echo "[INFO] Found recent script: $file"
done


# Response Priorities

*   **Immediate:**
    *   Block all listed domains (`livemicrosft.com`, `bull-run.fun`, `spot-wave.fun`) at the proxy and firewall.
    *   Scan all endpoints for the provided SHA256 file hashes.
    *   Isolate devices showing signs of ClickFix execution (terminal commands initiated from browser).
*   **24 Hours:**
    *   Conduct credential resets for users in targeted sectors (Finance/Tech) if potential credential theft is suspected.
    *   Audit Git repositories for unauthorized history pushes or malicious VS Code tasks.
*   **1 Week:**
    *   Implement strict allow-listing for VS Code extensions and workspace trust settings.
    *   Update security awareness training to include ClickFix (fake CAPTCHA/fake meeting) tactics.
    *   Restrict execution of unsigned Mach-O binaries.