macOS: OpenSSL decodes and decrypts payloads from mounted DMG volumes

Alerts on OpenSSL base64-decode/decrypt commands using DMG-mounted '/Volumes/' paths on macOS.

FreeUnreviewedSigmamediumv1

macos-openssl-decodes-and-decrypts-payloads-from-mounted-dmg-volumes-234dc5df

title: "macOS: OpenSSL decodes and decrypts payloads from mounted DMG volumes"
id: 4ab7eebe-4658-4ff4-8074-a41994119f03
status: test
description: This rule flags macOS process executions where the command line indicates OpenSSL usage to base64-decode and decrypt data from a mounted volume path. Such behavior matters because attackers can hide payloads inside disk images and only transform them into usable malware at execution time. The detection relies on process creation telemetry, specifically the executable path ending with '/openssl' and command-line arguments containing '/Volumes/', 'enc', '-base64', and the '-d' decrypt flag.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
  - attack.stealth
  - attack.t1059
  - attack.t1204
  - attack.execution
  - attack.t1140
  - attack.s0482
  - attack.s0402
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /openssl
    CommandLine|contains|all:
      - /Volumes/
      - enc
      - -base64
      - " -d "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 234dc5df-40b5-49d1-bf53-0d44ce778eca
    type: derived

What it detects

This rule flags macOS process executions where the command line indicates OpenSSL usage to base64-decode and decrypt data from a mounted volume path. Such behavior matters because attackers can hide payloads inside disk images and only transform them into usable malware at execution time. The detection relies on process creation telemetry, specifically the executable path ending with '/openssl' and command-line arguments containing '/Volumes/', 'enc', '-base64', and the '-d' decrypt flag.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.