{"id":"09a910bf-f71f-4737-9c40-88880ba5913d","title":"Potential Base64 Decoded From Images","description":"Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"high","date":"2023-12-20","modified":"","tags":["attack.stealth","attack.t1140"],"technique_ids":["T1140"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior","https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior"],"source_path":"rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml","source_sha256":"688aa4542fa6127e73cb4effded3baf6e36fb9d572db14884a6ae73436b76615","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Base64 Decoded From Images\nid: 09a910bf-f71f-4737-9c40-88880ba5913d\nstatus: test\ndescription: |\n    Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.\nreferences:\n    - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior\n    - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\ntags:\n    - attack.stealth\n    - attack.t1140\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # Example:  /bin/bash sh -c tail -c +21453 '/Volumes/Installer/Installer.app/Contents/Resources/workout-logo.jpeg' | base64 --decode > /tmp/54A0A2CD-FAD1-4D4D-AAF5-5266F6344ABE.zip\n    # VT Query: 'behavior_processes:\"tail\" (behavior_processes:\"jpeg\" or behavior_processes:\"jpg\" or behavior_processes:\"png\" or behavior_processes:\"gif\") behavior_processes:\"base64\" behavior_processes:\"--decode >\" and tag:dmg'\n    selection_image:\n        Image|endswith: '/bash'\n    selection_view:\n        CommandLine|contains|all:\n            - 'tail'\n            - '-c'\n    selection_b64:\n        CommandLine|contains|all:\n            - 'base64'\n            - '-d' # Also covers \"--decode\"\n            - '>'\n    selection_files:\n        CommandLine|contains:\n            - '.avif'\n            - '.gif'\n            - '.jfif'\n            - '.jpeg'\n            - '.jpg'\n            - '.pjp'\n            - '.pjpeg'\n            - '.png'\n            - '.svg'\n            - '.webp'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","page":"techniques/enterprise/T1140/"}],"data_path":"data/detection-rules/09a910bf-f71f-4737-9c40-88880ba5913d.json","kind":"sigma"}