Sigma rule: Potential Base64 Decoded From Images

Rule

Title

Potential Base64 Decoded From Images

Status

test

Level

high

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2023-12-20

File

rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

Log source

product

macos

category

process_creation

Detection

# Example:  /bin/bash sh -c tail -c +21453 '/Volumes/Installer/Installer.app/Contents/Resources/workout-logo.jpeg' | base64 --decode > /tmp/54A0A2CD-FAD1-4D4D-AAF5-5266F6344ABE.zip
# VT Query: 'behavior_processes:"tail" (behavior_processes:"jpeg" or behavior_processes:"jpg" or behavior_processes:"png" or behavior_processes:"gif") behavior_processes:"base64" behavior_processes:"--decode >" and tag:dmg'
selection_image:
    Image|endswith: '/bash'
selection_view:
    CommandLine|contains|all:
        - 'tail'
        - '-c'
selection_b64:
    CommandLine|contains|all:
        - 'base64'
        - '-d' # Also covers "--decode"
        - '>'
selection_files:
    CommandLine|contains:
        - '.avif'
        - '.gif'
        - '.jfif'
        - '.jpeg'
        - '.jpg'
        - '.pjp'
        - '.pjpeg'
        - '.png'
        - '.svg'
        - '.webp'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1140

MITRE ATT&CK ids this rule names

• T1140

References

• https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
• https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml