TwizAdmin MaaS & Lazarus Mach-O Man: Crypto Clipping, macOS ClickFix, and Middle East C2 Surge — Detection Pack

---
title: Potential ClickFix Activity - PowerShell via Browser
id: 5f8f4b3e-3c2a-4b1e-9f0d-1a2b3c4d5e6f
description: Detects suspicious PowerShell execution initiated by common browsers or office applications, a pattern consistent with ClickFix attacks used by Lazarus Group.
status: experimental
date: 2026/05/25
author: Security Arsenal
references:
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\OUTLOOK.EXE'
            - '\WINWORD.EXE'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate automation scripts
level: high
---
title: TwizAdmin C2 Network Connection
id: 6a9g5c4f-4d3b-5c2f-0g1e-2b3c4d5e6f7a
description: Detects network connections to known TwizAdmin C2 infrastructure or domains associated with the DataBreachPlus campaign.
status: experimental
date: 2026/05/25
author: Security Arsenal
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Suspicious macOS LaunchAgent Persistence
id: 7b0h6d5e-5e4c-6d3g-1h2f-3c4d5e6f7a8b
description: Detects creation of LaunchAgents in user library, a common persistence mechanism for macOS malware like Mach-O Man and PyLangGhostRAT.
status: experimental
date: 2026/05/25
author: Security Arsenal
references:
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
tags:
    - attack.persistence
    - attack.t1543.001
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|contains: '/Library/LaunchAgents/'
        TargetFilename|endswith: '.plist'
    filter:
        TargetFilename|contains:
            - 'com.apple.'
            - 'com.microsoft.'
    condition: selection and not filter
falsepositives:
    - Legitimate software installation
level: medium

// Hunt for TwizAdmin and Lazarus Indicators
let IoC_Domains = dynamic(["fanonlyatn.xyz", "livemicrosft.com"]);
let IoC_IPs = dynamic(["37.32.15.8", "197.51.170.131", "5.109.182.231", "93.113.62.247", "94.252.245.193"]);
let IoC_Hashes = dynamic(["06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90"]);
// Network Connections
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IoCType = iff(RemoteUrl in (IoC_Domains), "Domain", "IP")
// File Creation / Process Execution
| union (DeviceProcessEvents
| where SHA256 in (IoC_Hashes)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
| extend IoCType = "Hash")
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt script for TwizAdmin artifacts and potential ClickFix execution traces.
.DESCRIPTION
    Checks for file artifacts associated with TwizAdmin C2 and recent suspicious PowerShell executions.
#>

$TwizAdminDomains = @("fanonlyatn.xyz")
$RiskPaths = @("$env:TEMP", "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup")

# Check for recent PowerShell processes spawned by Browsers
Write-Host "[*] Checking for ClickFix-like parent-child process relationships..."
$parentProcs = @("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -ErrorAction SilentlyContinue | 
Where-Object { 
    $_.Message -match "NewProcessName.*powershell.exe" -and 
    ($parentProcs | Where-Object { $_.Message -match "ParentProcessName.*$_" })
} | Select-Object TimeCreated, Message | Format-List

# Scan for known malicious file hashes in user directories
Write-Host "[*] Scanning for known IOCs in user directories..."
$knownHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4"
)

foreach ($path in $RiskPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
        Where-Object { $knownHashes -contains $_.Hash } | 
        Select-Object Path, Hash
    }
}