title: Potential Laravel Supply Chain Compromise - DebugChromium Execution
id: 1e3d8f9a-2b4c-4e5f-8a9b-0c1d2e3f4a5b
description: Detects execution of DebugChromium.exe or suspicious helpers.php processes associated with the Laravel Lang compromise.
status: experimental
date: 2026/05/25
author: Security Arsenal
references:
    - https://socket.dev/blog/laravel-lang-compromise
tags:
    - attack.supply_chain
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\DebugChromium.exe'
            - '\php.exe'
        CommandLine|contains:
            - 'helpers.php'
            - 'flipboxstudio.info'
    condition: selection
falsepositives:
    - Legitimate developer debugging
level: high
---
title: TwizAdmin & Lazarus C2 Network Traffic
id: 2b4c9e0a-3d5f-4e6f-9b0c-1d2e3f4a5b6c
description: Identifies network connections to known C2 domains used by TwizAdmin and Lazarus Group campaigns.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
tags:
    - attack.c2
    - attack.command_and_control
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
            - 'livemicrosft.com'
            - 'flipboxstudio.info'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Cloud Atlas APT LNK Phishing Pattern
id: 3c5d0f1b-4e6f-5a7b-0c1d-2e3f4a5b6c7d
description: Detects execution of LNK files initiating PowerShell with specific obfuscation patterns used by Cloud Atlas.
status: experimental
date: 2026/05/25
author: Security Arsenal
references:
    - https://securelist.com/cloud-atlas-2026/119895/
tags:
    - attack.initial_access
    - attack.execution
    - apt.cloud_atlas
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        ParentImage|endswith: '\cmd.exe' # LNK often spawns cmd which spawns powershell
    selection_indicator:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'FromBase64String'
    condition: all of selection_*
falsepositives:
    - Administrative scripts
level: high

// Hunt for TwizAdmin, Laravel Backdoor, and Lazarus Indicators
let IOCs = dynamic(["fanonlyatn.xyz", "livemicrosft.com", "flipboxstudio.info", "DebugChromium.exe", "mcpAddon.js"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or InitiatingProcessFileName has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, Action
| union (
    DeviceProcessEvents
    | where FileName in ("DebugChromium.exe", "powershell.exe", "cmd.exe") 
    | where ProcessCommandLine has_any ("helpers.php", "flipboxstudio.info", "livemicrosft.com", "Invoke-Expression")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
)

# IOC Hunter for TwizAdmin, Laravel, and Lazarus Campaigns
Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check Hosts File for Typosquatting
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$maliciousDomains = @("livemicrosft.com", "fanonlyatn.xyz", "flipboxstudio.info")
$hostsContent = Get-Content $hostsPath

foreach ($domain in $maliciousDomains) {
    if ($hostsContent -match $domain) {
        Write-Host "[ALERT] Malicious domain found in hosts file: $domain" -ForegroundColor Red
    }
}

# 2. Check for Suspicious Processes
$suspiciousProcesses = @("DebugChromium.exe", "java.exe")
$found = Get-Process | Where-Object { $suspiciousProcesses -contains $_.ProcessName }
if ($found) {
    Write-Host "[ALERT] Suspicious process running:" -ForegroundColor Red
    $found | Select-Object ProcessName, Id, Path
}

# 3. Scan User Profile for mcpAddon.js (KICS Compromise)
$userProfile = $env:USERPROFILE
$jsPath = "$userProfile\.vscode\extensions\*\mcpAddon.js"
if (Test-Path $jsPath) {
    Write-Host "[ALERT] Potential KICS compromise artifact found: $jsPath" -ForegroundColor Red
}

Write-Host "Hunt Complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:** Block all domains listed in the IOC Analysis at the perimeter firewall and proxy servers. Initiate a hunt for `DebugChromium.exe` and `mcpAddon.js` across all endpoints.
*   **24 Hours:** Force a password reset for developer accounts with access to Laravel repositories and Docker Hub credentials. Validate the integrity of current Docker images (specifically KICS tags v2.1.20, v2.1.21).
*   **1 Week:** Implement strict package pinning for npm and Composer dependencies. Enforce application control (AppLocker) to block unsigned binaries like the Mach-O payloads and unverified Java RATs.