macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File
Alerts on bash on macOS that tails image bytes, base64-decodes them, and writes decoded output to a new file.
- Product
- macos
- Category
- process_creation
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2023-12-20
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies macOS process executions where a bash command uses tail with byte offsets (tail -c ...) on an image file type and pipes the extracted bytes into base64 for decoding, redirecting the result to a new file. Attackers may use this technique to hide or reconstruct payloads embedded in seemingly benign images and then write the decoded content to disk. Telemetry relies on process creation data capturing the bash command line, including tail usage, base64 decode flags, output redirection, and the presence of common image file extensions in the command line.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
- virustotal.comhttps://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File
id: 33cffdd9-0e9a-4e26-8db5-fea69c760c44
status: test
description: This rule identifies macOS process executions where a bash command uses tail with byte offsets (tail -c ...) on an image file type and pipes the extracted bytes into base64 for decoding, redirecting the result to a new file. Attackers may use this technique to hide or reconstruct payloads embedded in seemingly benign images and then write the decoded content to disk. Telemetry relies on process creation data capturing the bash command line, including tail usage, base64 decode flags, output redirection, and the presence of common image file extensions in the command line.
references:
- https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
- https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
tags:
- attack.stealth
- attack.t1140
logsource:
product: macos
category: process_creation
detection:
selection_image:
Image|endswith: /bash
selection_view:
CommandLine|contains|all:
- tail
- -c
selection_b64:
CommandLine|contains|all:
- base64
- -d
- ">"
selection_files:
CommandLine|contains:
- .avif
- .gif
- .jfif
- .jpeg
- .jpg
- .pjp
- .pjpeg
- .png
- .svg
- .webp
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 09a910bf-f71f-4737-9c40-88880ba5913d
type: derived