Potential Base64 Decoded From Images

Title: Potential Base64 Decoded From Images
Status: test
Description:Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.
References:
  -https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
  -https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-20
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1140'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection_image:
    Image|endswith: '/bash'
  selection_view:
    CommandLine|contains|all:
      -'tail'
      -'-c'

  selection_b64:
    CommandLine|contains|all:
      -'base64'
      -'-d'
      -'>'

  selection_files:
    CommandLine|contains:
      -'.avif'
      -'.gif'
      -'.jfif'
      -'.jpeg'
      -'.jpg'
      -'.pjp'
      -'.pjpeg'
      -'.png'
      -'.svg'
      -'.webp'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high