{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","description":"Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-17","modified":"","tags":["attack.stealth","attack.t1059","attack.t1204","attack.execution","attack.t1140","attack.s0482","attack.s0402"],"technique_ids":["T1059","T1140","T1204"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Unknown"],"references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823"],"source_path":"rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","source_sha256":"047c0927959706f41393a197878e3fd8c38d1dbe6b2abd9ca0088cb47b7c2645","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Payload Decoded and Decrypted via Built-in Utilities\nid: 234dc5df-40b5-49d1-bf53-0d44ce778eca\nstatus: test\ndescription: Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.\nreferences:\n    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823\nauthor: Tim Rauch (rule), Elastic (idea)\ndate: 2022-10-17\ntags:\n    - attack.stealth\n    - attack.t1059\n    - attack.t1204\n    - attack.execution\n    - attack.t1140\n    - attack.s0482\n    - attack.s0402\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/openssl'\n        CommandLine|contains|all:\n            - '/Volumes/'\n            - 'enc'\n            - '-base64'\n            - ' -d '\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1140","id":"T1140","name":"Deobfuscate/Decode Files or Information","page":"techniques/enterprise/T1140/"},{"key":"enterprise/T1204","id":"T1204","name":"User Execution","page":"techniques/enterprise/T1204/"}],"data_path":"data/detection-rules/234dc5df-40b5-49d1-bf53-0d44ce778eca.json","kind":"sigma"}