TwizAdmin & Mach-O Man Credential Campaigns: ClickFix & Supply Chain Threats — Detection Pack

title: Potential macOS ClickFix Terminal Execution
id: 8f7e9a1b-2c3d-4f5e-8b9a-1c2d3e4f5a6b
date: 2026/04/23
status: experimental
description: Detects suspicious terminal execution often used in ClickFix campaigns where users are tricked into running a command string.
references:
    - https://otx.alienvault.com/pulse/6264d5a8-1c2e-1234-5678-1234567890ab
author: Security Arsenal
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/bin/zsh'
            - '/usr/bin/osascript'
        ParentImage|endswith:
            - '/Terminal.app/Contents/MacOS/Terminal'
            - '/iTerm.app/Contents/MacOS/iTerm2'
        CommandLine|contains:
            - 'curl' 
            - 'wget'
            - 'python3 -c'
            - 'pip install'
    condition: selection
falsepositives:
    - Legitimate developer administration
level: high
tags:
    - attack.execution
    - attack.t1059.004
    - os.macos
    - clickfix

---

title: VS Code Exploitation via Malicious Tasks
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
date: 2026/04/23
status: experimental
description: Detects execution of suspicious commands via VS Code terminal or tasks, indicative of Void Dokkaebi supply chain attack.
references:
    - https://otx.alienvault.com/pulse/6264d5a8-1c2e-1234-5678-1234567890ac
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\\Code.exe'
            - '\\code-insiders.exe'
            - '\
ode.exe'
            - '\\cmd.exe'
            - '\\powershell.exe'
    selection_cli:
        CommandLine|contains:
            - '.vscode/tasks.'
            - 'npm run'
            - 'npm install'
            - 'node index.js'
            - 'extension.js'
    condition: all of selection_*
falsepositives:
    - Legitimate developer workflow
level: medium
tags:
    - attack.initial_access
    - attack.t1195.002
    - supply.chain
    - void.dokkaebi

---

title: TwizAdmin C2 Network Activity
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
date: 2026/04/23
status: experimental
description: Detects network connections to known TwizAdmin C2 infrastructure or domains associated with the operation.
references:
    - https://otx.alienvault.com/pulse/6264d5a8-1c2e-1234-5678-1234567890ad
author: Security Arsenal
logsource:
    category: network_connection\    product: windows
detection:
    selection_ip:
        DestinationIp|startswith:
            - '31.31.198.'
            - '103.241.66.'
    selection_domain:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
    selection_port:
        DestinationPort: 1337
    condition: 1 of selection_*
falsepositives:
    - Rare
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - c2
    - twizadmin

// Hunt for ClickFix and Malware Domains
let IOC_Domains = dynamic([\"fanonlyatn.xyz\", \"livemicrosft.com\", \"bull-run.fun\", \"spot-wave.fun\", \"moonscan.live\", \"scanclaw.live\"]);
let IOC_IPs = dynamic([\"31.31.198.206\", \"166.88.4.2\", \"85.239.62.36\", \"23.27.20.143\", \"172.94.9.250\"]);
// Network Events
DeviceNetworkEvents
| where RemoteUrl in~ (IOC_Domains) or RemoteIP in~ (IOC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| union (
    DeviceProcessEvents
    // Look for suspicious script execution patterns associated with ClickFix
    | where ProcessCommandLine has_any (\"curl\", \"wget\", \"powershell -c\", \"python3 -c\") 
       and (ProcessCommandLine has \"http\" or ProcessCommandLine has \"pastebin\" or ProcessCommandLine has \"127.0.0.1\")
    | where Timestamp > ago(7d)
)
| summarize count() by DeviceName, bin(Timestamp, 1h)
| order by count_ desc

#!/bin/bash
# IOC Hunt Script for macOS/Linux endpoints
# Checks for network connections to malicious IPs and suspicious file hashes

echo \"[*] Starting Hunt for TwizAdmin/Mach-OMan Indicators...\"

# Malicious IPs from Pulses
MAL_IPS=(\"31.31.198.206\" \"166.88.4.2\" \"172.94.9.250\" \"103.241.66.238\")

# Check Established Connections
for ip in \"${MAL_IPS[@]}\"; do
    CONNS=$(netstat -an | grep ESTABLISHED | grep \"$ip\")
    if [ ! -z \"$CONNS\" ]; then
        echo \"[!] ALERT: Established connection found to $ip\"
        echo \"$CONNS\"
    fi
done

# Check for Suspicious Domains in Hosts or Resolutions (Simulated)
MAL_DOMAINS=(\"fanonlyatn.xyz\" \"livemicrosft.com\" \"bull-run.fun\")
for domain in \"${MAL_DOMAINS[@]}\"; do
    # grep /etc/hosts just in case of static poisoning
    if grep -q \"$domain\" /etc/hosts; then
        echo \"[!] ALERT: $domain found in /etc/hosts\"
    fi
done

# Check for known malware file paths (if specific paths were known, else generic temp dirs)
echo \"[*] Scanning common download directories for suspicious executables...\"
USER_DIRS=/Users
find $USER_DIRS -type f \\( -name \".zshrc\" -o -name \".bash_profile\" \\) -exec grep -l \"curl.*sh\" {} \\; 2>/dev/null

echo \"[*] Hunt Complete.\"