TwizAdmin MaaS & Lazarus Mach-O Man: OTX Pulse Analysis — Multi-Platform C2 & ClickFix Detection Pack

title: Potential TwizAdmin C2 Connection
id: 5c8a2d1a-1e4f-4c2e-9b3a-8d6f7a5b4c3d
description: Detects outbound connections to known TwizAdmin C2 infrastructure domains or IPs.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
        DestinationIp|startswith:
            - '103.241.66.'
    condition: selection
falsepositives:
    - Legitimate traffic to specific IP ranges (unlikely)
level: high
---
title: Lazarus Mach-O Man ClickFix Pattern macOS
date: 2026/05/22
id: 9e1b4f2a-3d5e-4f6a-8b7c-9d0e1f2a3b4c
description: Detects suspicious terminal execution spawned by communication applications consistent with ClickFix attacks targeting macOS.
status: experimental
author: Security Arsenal
references:
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: macos
detection:
    selection_parent:
        ParentImage|endswith:
            - '/Telegram'
            - '/Microsoft Teams'
            - '/Zoom'
            - '/Google Chrome'
            - '/Safari'
    selection_child:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/zsh'
            - '/osascript'
        CommandLine|contains:
            - 'curl'
            - 'launchctl'
    condition: all of selection_*
falsepositives:
    - Legitimate developer activity using terminal from browsers/apps
level: high
---
title: Middle East C2 Infrastructure Beaconing
date: 2026/05/22
id: b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
description: Detects outbound connections to identified C2 servers hosting threat actor infrastructure in the Middle East.
status: experimental
author: Security Arsenal
references:
    - https://hunt.io/blog/middle-east-malicious-infrastructure-report
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp:
            - '37.32.15.8'
            - '197.51.170.131'
            - '5.109.182.231'
            - '93.113.62.247'
            - '94.252.245.193'
    condition: selection
falsepositives:
    - Unknown
level: critical

// Hunt for TwizAdmin and Lazarus Mach-O Man Network Indicators
let IoC_Domains = dynamic(["fanonlyatn.xyz", "livemicrosft.com"]);
let IoC_IPs = dynamic(["37.32.15.8", "197.51.170.131", "5.109.182.231", "93.113.62.247", "94.252.245.193", "103.241.66.238"]);
DeviceNetworkEvents
| where (RemoteUrl has_any (IoC_Domains) or RemoteIP in (IoC_IPs))
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| extend IoC_Type = iff(RemoteIP in (IoC_IPs), "IP Address", "Domain")


kql
// Hunt for Mach-O Man related process creation on macOS (via Microsoft Sentinel/Defender for Endpoint)
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where OSType == "macOS"
| where InitiatingProcessFileName in~ ("Telegram", "Microsoft Teams", "zoom.us", "Google Chrome", "Safari")
| where FileName in~ ("bash", "sh", "zsh", "osascript", "python")
| where ProcessCommandLine has_any ("curl", "wget", "pip", "launchctl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

# IOC Hunter for TwizAdmin and Middle East Infrastructure
# Requires Administrator privileges

$IoC_IPs = @(
    "37.32.15.8",
    "197.51.170.131",
    "5.109.182.231",
    "93.113.62.247",
    "94.252.245.193"
)

$IoC_Domains = @(
    "fanonlyatn.xyz",
    "livemicrosft.com"
)

Write-Host "[+] Checking for established network connections to known C2 IPs..." -ForegroundColor Yellow

$activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($ip in $IoC_IPs) {
    $matches = $activeConnections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($matches) {
        Write-Host "[!!!] ALERT: Connection found to C2 IP $ip" -ForegroundColor Red
        $matches | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
    }
}

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Yellow

$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $IoC_Domains) {
    $matches = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($matches) {
        Write-Host "[!!!] ALERT: DNS cache entry found for $domain" -ForegroundColor Red
        $matches | Select-Object Entry, Data, TimeToLive
    }
}

Write-Host "[+] Scan Complete. If alerts are found, isolate the host immediately." -ForegroundColor Cyan