macOS Bash Pipeline: Tail Extracting Data from Image and Base64-Decoding Output

Alerts on bash on macOS that tails image bytes, base64-decodes them, and writes decoded output to a new file.

FreeUnreviewedSigmahighv1

macos-bash-pipeline-tail-extracting-data-from-image-and-base64-decoding-output-09a910bf

title: "macOS Bash Pipeline: Tail Extracting Data from Image and Base64-Decoding Output"
id: 33cffdd9-0e9a-4e26-8db5-fea69c760c44
status: test
description: This rule flags macOS process executions where a bash command uses tail with a byte offset (via -c) to extract data from an image file and then pipes it to base64 for decoding to a new output file. Attackers may embed or conceal payloads inside image-like files and reconstruct the decoded content at runtime. Telemetry relies on macOS process creation command-line arguments showing tail extraction, base64 decoding (including -d/--decode), and redirection to a file.
references:
  - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
  - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: macos
  category: process_creation
detection:
  selection_image:
    Image|endswith: /bash
  selection_view:
    CommandLine|contains|all:
      - tail
      - -c
  selection_b64:
    CommandLine|contains|all:
      - base64
      - -d
      - ">"
  selection_files:
    CommandLine|contains:
      - .avif
      - .gif
      - .jfif
      - .jpeg
      - .jpg
      - .pjp
      - .pjpeg
      - .png
      - .svg
      - .webp
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 09a910bf-f71f-4737-9c40-88880ba5913d
    type: derived

What it detects

This rule flags macOS process executions where a bash command uses tail with a byte offset (via -c) to extract data from an image file and then pipes it to base64 for decoding to a new output file. Attackers may embed or conceal payloads inside image-like files and reconstruct the decoded content at runtime. Telemetry relies on macOS process creation command-line arguments showing tail extraction, base64 decoding (including -d/--decode), and redirection to a file.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.