TwizAdmin, Lazarus Mach-O Man & Supply Chain Attacks: OTX Pulse Analysis — Enterprise Detection Pack

title: Suspicious PowerShell PNG Access (PureLogs PawsRunner)
id: 3c7b6f8a-1d9e-4f5a-b2c3-0e9f8a7b6c5d
description: Detects PowerShell accessing PNG files in a manner consistent with steganography payload extraction, as seen in PureLogs campaigns.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6427349f8a1b4c9f8d7e6f5a
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - '.png'
            - 'System.Drawing.Bitmap'
            - 'System.IO.MemoryStream'
    condition: selection
falsepositives:
    - Legitimate image processing scripts
level: high
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.execution
---
title: macOS Fake Collaboration Tool Execution (Mach-O Man)
id: 9d8e7f6a-5b4c-4a3d-9e1f-2c3b4a5d6e7f
description: Detects macOS terminal commands spawned by communication apps or browsers, indicative of Lazarus Group Mach-O Man ClickFix attacks.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6427349f8a1b4c9f8d7e6f5b
logsource:
    product: macos
    category: process_creation
detection:
    selection_parent:
        Image|contains:
            - 'Telegram'
            - 'Chrome'
            - 'Firefox'
            - 'Safari'
    selection_child:
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/bin/zsh'
            - '/usr/bin/osascript'
        CommandLine|contains:
            - 'curl'
            - 'wget'
            - 'cd /tmp'
    condition: all of selection_*
falsepositives:
    - Administrative troubleshooting via terminal
level: critical
tags:
    - attack.initial_access
    - attack.t1189
    - attack.execution
---
title: TwizAdmin C2 Network Activity
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects network connections to known TwizAdmin C2 infrastructure or FastAPI panels on non-standard ports.
status: experimental
date: 2026/05/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6427349f8a1b4c9f8d7e6f5a
logsource:
    category: network_connection
detection:
    selection_ip:
        DestinationIp|contains:
            - '103.241.66.238'
    selection_domain:
        DestinationDomain|contains:
            - 'fanonlyatn.xyz'
    selection_port:
        DestinationPort:
            - 1337
    condition: 1 of selection_
falsepositives:
    - Low
level: high
tags:
    - attack.c2
    - attack.t1071


kql// Hunt for FrostyNeighbor Domains (FrostyNeighbor Pulse)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_suffix (".icu") 
| where RemoteUrl has_any ("alexavegas", "needbinding", "algsat")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// Hunt for PureLogs/PawsRunner Execution (PureLogs Pulse)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "powershell.exe"
| where ProcessCommandLine has ".png" and (ProcessCommandLine has "FromBase64String" or ProcessCommandLine has "MemoryStream")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessParentFileName


powershell# IOC Hunt Script for TwizAdmin and Mach-O Man Hashes
# Requires administrative privileges

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", # TwizAdmin
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4", # TwizAdmin
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527", # TwizAdmin
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90", # Mach-O Man
    "24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9"  # Mach-O Man
)

$DrivesToScan = @("C:\", "D:\")
$MatchesFound = @()

Write-Host "[+] Starting hunt for known TwizAdmin and Mach-O Man hashes..." -ForegroundColor Cyan

foreach ($Drive in $DrivesToScan) {
    if (Test-Path $Drive) {
        Write-Host "[+] Scanning $Drive..." -ForegroundColor Yellow
        try {
            $Files = Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue -File
            foreach ($File in $Files) {
                $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($Hash -in $TargetHashes) {
                    $MatchesFound += [PSCustomObject]@{
                        FilePath = $File.FullName
                        Hash     = $Hash
                        Detected = (Get-Date)
                    }
                }
            }
        } catch {
            Write-Host "[-] Error accessing $Drive" -ForegroundColor Red
        }
    }
}

if ($MatchesFound.Count -gt 0) {
    Write-Host "[!] THREAT DETECTED: Found $($MatchesFound.Count) matching files." -ForegroundColor Red
    $MatchesFound | Format-Table -AutoSize
} else {
    Write-Host "[+] No matching files found." -ForegroundColor Green
}