Suspicious Payload Decoded and Decrypted through Built-in Utilities (via process_creation)

title: Suspicious Payload Decoded and Decrypted through Built-in Utilities (via process_creation)
id: 559f5b2d-9a20-569e-a627-532f439707ba
status: stable
description: This rule detects when a built-in utility is leveraged to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into running hostile code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
references:
    - https://attack.mitre.org/techniques/T1140/
    - https://attack.mitre.org/techniques/T1204/
    - https://attack.mitre.org/techniques/T1059/
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823
author: Huntrule Team
date: 2026-06-16
tags:
    - attack.stealth
    - attack.t1059
    - attack.t1204
    - attack.execution
    - attack.t1140
    - attack.s0482
    - attack.s0402
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/openssl'
        CommandLine|contains|all:
            - '/Volumes/'
            - 'enc'
            - '-base64'
            - ' -d '
    condition: selection
falsepositives:
    - Unknown
level: medium