huntrule

macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File

Alerts on bash on macOS that tails image bytes, base64-decodes them, and writes decoded output to a new file.

FreeReviewedSigma · High · v2
Product
macos
Category
process_creation
Author
Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published
2023-12-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies macOS process executions where a bash command uses tail with byte offsets (tail -c ...) on an image file type and pipes the extracted bytes into base64 for decoding, redirecting the result to a new file. Attackers may use this technique to hide or reconstruct payloads embedded in seemingly benign images and then write the decoded content to disk. Telemetry relies on process creation data capturing the bash command line, including tail usage, base64 decode flags, output redirection, and the presence of common image file extensions in the command line.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang
Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)
Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr
Suspicious Python Inline Deobfuscation and Execution One-Liner
Suspicious Base64 Decoded Payload Piped to Shell on Linux
Suspicious Remote File Download via certutil URLCache (via process_creation)
Malicious certutil Decodehex Payload Reconstruction by DarkGate
Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)
macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File
Pivot detection · T1140 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.