Detectionhightest

Potential Base64 Decoded From Images

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Joseliyo SanchezCreated Wed Dec 2009a910bf-f71f-4737-9c40-88880ba5913dmacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # Example:  /bin/bash sh -c tail -c +21453 '/Volumes/Installer/Installer.app/Contents/Resources/workout-logo.jpeg' | base64 --decode > /tmp/54A0A2CD-FAD1-4D4D-AAF5-5266F6344ABE.zip
    # VT Query: 'behavior_processes:"tail" (behavior_processes:"jpeg" or behavior_processes:"jpg" or behavior_processes:"png" or behavior_processes:"gif") behavior_processes:"base64" behavior_processes:"--decode >" and tag:dmg'
    selection_image:
        Image|endswith: '/bash'
    selection_view:
        CommandLine|contains|all:
            - 'tail'
            - '-c'
    selection_b64:
        CommandLine|contains|all:
            - 'base64'
            - '-d' # Also covers "--decode"
            - '>'
    selection_files:
        CommandLine|contains:
            - '.avif'
            - '.gif'
            - '.jfif'
            - '.jpeg'
            - '.jpg'
            - '.pjp'
            - '.pjpeg'
            - '.png'
            - '.svg'
            - '.webp'
    condition: all of selection_*