macOS ClickFix: base64-piped bash execution via Terminal

Ibrahim Saud@tektrix

•updated 10 days ago•1•0•1

Detects the execution of bash commands containing base64 decoding instructions, often used by adversaries to decode and execute obfuscated scripts or payloads. The rule specifically looks for command lines invoking base64 along with keywords like 'echo' or 'reCAPTCHA', which are commonly associated with malicious droppers or phishing-related scripts.