macOS Base64 Utility Decoding Command Activity

Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.

FreeReviewedSigma · Low · v2

Product: macos
Category: process_creation
Author: Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-19
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of /usr/bin/base64 where the command line includes the -d option, indicating Base64 decoding of provided input. Attackers often use built-in encoders/decoders to transform data for concealment, staging, or executing follow-on actions while blending into normal utilities. It relies on process creation telemetry capturing the executed image path and the command-line arguments containing -d.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Suspicious Hidden PowerShell Executing Substring of Dropped File

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

macOS Base64 Utility Decoding Command Activity

Pivot detection · T1027 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-base64-decoding-via-usr-bin-base64-d-719c22d7

title: macOS Base64 Utility Decoding Command Activity
id: 41cc510b-5699-4c16-9e2a-8c983024b82f
status: test
description: This rule identifies process executions of /usr/bin/base64 where the command line includes the -d option, indicating Base64 decoding of provided input. Attackers often use built-in encoders/decoders to transform data for concealment, staging, or executing follow-on actions while blending into normal utilities. It relies on process creation telemetry capturing the executed image path and the command-line arguments containing -d.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_base64_decode.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-26
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image: /usr/bin/base64
    CommandLine|contains: -d
  condition: selection
falsepositives:
  - Legitimate activities
level: low
license: DRL-1.1
related:
  - id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL