TwizAdmin, Mach-O Man & KICS Supply Chain Compromise: OTX Pulse Analysis — Enterprise Detection Pack

title: Suspicious PowerShell Command Line Base64 Decode
description: Detects PowerShell commands with base64 decoding often used by PureLogs PawsRunner and other loaders.
references:
  - https://otx.alienvault.com/pulse/664d7e63e8c7b31ac7418608
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'FromBase64String'
      - 'FromBase64CharArray'
      - ' -enc '
      - ' -encodedcommand '
  condition: selection
falsepositives:
  - Administrative scripts
level: high

date: 2026/05/23
---
title: TwizAdmin C2 Network Connection
description: Detects network connections to known TwizAdmin C2 infrastructure fanonlyatn.xyz.
references:
  - https://otx.alienvault.com/pulse/664d7e63e8c7b31ac7418608
tags:
  - attack.command_and_control
  - attack.c2
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'fanonlyatn.xyz'
  condition: selection
falsepositives:
  - Unknown
level: critical

date: 2026/05/23
---
title: Potential CVE-2023-38831 Exploitation WinRAR
description: Detects suspicious process creation patterns indicative of WinRAR exploit chain used by FrostyNeighbor.
references:
  - https://otx.alienvault.com/pulse/664d7e63e8c7b31ac7418608
tags:
  - attack.initial_access
  - attack.t1203
  - cve.2023.38831
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|endswith:
      - '\WinRAR.exe'
      - '\rar.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate archive extraction scripts
level: high

date: 2026/05/23

// Hunt for TwizAdmin and Lazarus C2 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("fanonlyatn.xyz", "livemicrosft.com", "everycarebd.com") 
   or RemoteUrl contains "alexavegas.icu" 
   or RemoteUrl contains "needbinding.icu"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| extend ThreatActor = case(
    RemoteUrl contains "fanonlyatn", "TwizAdmin",
    RemoteUrl contains "livemicrosft", "Lazarus/Mach-O Man",
    RemoteUrl contains "everycarebd", "PureLogs",
    RemoteUrl contains "icu", "FrostyNeighbor",
    "Unknown"
)

// Hunt for Steganography/PowerShell Loader behavior (PureLogs)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "FromBase64String" or ProcessCommandLine has "-enc"
| where ProcessCommandLine has "System.Drawing" or ProcessCommandLine has "Bitmap" 
   // Common in steganography loaders like PawsRunner
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt for TwizAdmin, Mach-O Man, and Supply Chain Artifacts
$ErrorActionPreference = "SilentlyContinue"

Write-Host "[*] Starting IOC Hunt for OTX Pulse Activity..." -ForegroundColor Cyan

# 1. Check for specific file hashes mentioned in pulses
Write-Host "\n[+] Scanning for Malicious File Hashes..." -ForegroundColor Yellow
$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", # TwizAdmin
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90", # Mach-O Man (Conceptual check)
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b"  # KICS Malicious
)

$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($Hash in $TargetHashes) {
    foreach ($Drive in $Drives) {
        Write-Host "   Checking for hash $Hash on $Drive..."
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $_.Hash -eq $Hash } | Select-Object Path, Hash | Format-Table -AutoSize
    }
}

# 2. Check for Persistence Mechanisms (Scheduled Tasks)
Write-Host "\n[+] Checking Scheduled Tasks for suspicious triggers..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -and $_.Actions.Arguments -like "*enc*" } | Select-Object TaskName, TaskPath, Actions | Format-List

# 3. Check Host File Entries for Typosquatting
Write-Host "\n[+] Checking Hosts file for Lazarus Typosquatting..." -ForegroundColor Yellow
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    Select-String -Path $HostsPath -Pattern "livemicrosft|fanonlyatn|everycarebd" -SimpleMatch
}

Write-Host "\n[*] Hunt Complete." -ForegroundColor Green