TwizAdmin, Lazarus & KICS Supply Chain: Multi-Vector Infostealer Analysis — Enterprise Detection Pack

title: Potential Steganography Loader via PowerShell
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects PowerShell scripts loading images for steganography (PawsRunner/PureLogs technique).
references:
    - https://www.fortinet.com/blog/threat-research/purelogs-delivery-via-pawsrunner-steganography
author: Security Arsenal
date: 2026/05/25
tags:
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'System.Drawing'
            - 'FromStream'
            - 'Bitmap'
    condition: selection
falsepositives:
    - Legitimate image processing scripts
level: high
---
title: Java Process Suspicious Network Connection
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Java processes establishing connections on non-standard ports, potentially indicating Java RAT (TwizAdmin) or C2 activity.
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
author: Security Arsenal
date: 2026/05/25
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        Image|endswith:
            - '\javaw.exe'
            - '\java.exe'
        DestinationPort|notin:
            - 80
            - 443
    condition: selection
falsepositives:
    - Legitimate Java applications using custom ports
level: medium
---
title: ClickFix / Fake Meeting Invite Pattern
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects suspicious command line execution often associated with "ClickFix" attacks used by Lazarus (Mach-O Man) or similar social engineering campaigns.
references:
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
author: Security Arsenal
date: 2026/05/25
tags:
    - attack.initial_access
    - attack.t1566
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        CommandLine|contains:
            - 'mshta'
            - 'powershell'
        CommandLine|contains:
            - 'meeting'
            - 'teams'
            - 'zoom'
            - 'invite'
    condition: selection
falsepositives:
    - Legitimate meeting software installation or access
level: high


kql// Hunt for known malicious domains and IPs from the pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "fanonlyatn.xyz" 
   or RemoteUrl has "livemicrosft.com" 
   or RemoteUrl has "everycarebd.com" 
   or RemoteIP == "5.101.84.202"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// Hunt for file creation events matching malicious hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b",
    "0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e"
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName

// Hunt for PowerShell steganography behavior (PureLogs)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoProductName contains "PowerShell"
| where ProcessCommandLine has "System.Drawing" or ProcessCommandLine has "Bitmap"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName


powershell# IOC Hunt Script for TwizAdmin and PureLogs
# Checks for specific file hashes and suspicious script execution.

$MaliciousHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e",
    "1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f9",
    "24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9"
)

Write-Host "[+] Scanning for known malicious file hashes..."

$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Write-Host "[!] Scanning drive $Drive"
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($Hash -in $MaliciousHashes) {
            Write-Host "[!!!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for suspicious TwizAdmin C2 Registry Keys..."
$RegPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Path in $RegPaths) {
    if (Test-Path $Path) {
        Get-Item -Path $Path | Select-Object -ExpandProperty Property | ForEach-Object {
            $Value = (Get-ItemProperty -Path $Path -Name $_).$_
            if ($Value -match "103.241.66" -or $Value -match "1337" -or $Value -match "java" -or $Value -match "fanonlyatn") {
                Write-Host "[!!!] SUSPICIOUS PERSISTENCE FOUND in $Path : $_ = $Value" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[+] Hunt complete."