macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume

Alerts on OpenSSL base64-decode/decrypt commands using DMG-mounted '/Volumes/' paths on macOS.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-10-17
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
- T1204User Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of the openssl binary on macOS where the command line references a mounted /Volumes/ path and uses base64 decoding together with decryption-related arguments. Such behavior can indicate malware attempting to evade static detection by storing an encoded and encrypted payload inside a disk image and decrypting it after execution. Telemetry relies on process creation logs that capture the executed image path and the full command line.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Suspicious CherryLoader Execution via Encrypted Stage Arguments (via process_creation)

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Suspicious Python Execution via Renamed Synaptics Binary

Hidden PowerShell Archive Extraction via ExtractToDirectory

Malicious Shell Payload Piped from curl to zsh

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume

Pivot detection · T1140 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-openssl-decodes-and-decrypts-payloads-from-mounted-dmg-volumes-234dc5df

title: "macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume"
id: 4ab7eebe-4658-4ff4-8074-a41994119f03
status: test
description: This rule identifies process executions of the openssl binary on macOS where the command line references a mounted /Volumes/ path and uses base64 decoding together with decryption-related arguments. Such behavior can indicate malware attempting to evade static detection by storing an encoded and encrypted payload inside a disk image and decrypting it after execution. Telemetry relies on process creation logs that capture the executed image path and the full command line.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
  - attack.stealth
  - attack.t1059
  - attack.t1204
  - attack.execution
  - attack.t1140
  - attack.s0482
  - attack.s0402
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /openssl
    CommandLine|contains|all:
      - /Volumes/
      - enc
      - -base64
      - " -d "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 234dc5df-40b5-49d1-bf53-0d44ce778eca
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL