Techniques › T1204.004 › AN0964
AN0964 Analytic 0964
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User pastes an obfuscated command into Terminal.app/iTerm2 that decodes or downloads code and executes. Detects Terminal/iTerm2 spawning bash/zsh/python with suspicious pipeline/base64 patterns followed by file writes in ~/Library or /tmp and outbound network connections.</p>
- Detects
- T1204.004 Malicious Copy and Paste
- Part of
- DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python*) AND CommandLine matches '(curl|wget).*(\||\|\s*sh|bash)|base64 -D|python -c' | DC0032 Process Creation |
| macos:osquery | Interpreter exec with suspicious arguments as above | DC0064 Command Execution |
| macos:unifiedlog | create: New files in /tmp or ~/Library/Application Support/* with executable or script extensions | DC0039 File Creation |
| NSM:Flow | Egress to non-approved networks from host after terminal exec | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ParentAppScope | Terminal apps to treat as user-paste origins (Terminal, iTerm2, VSCode integrated terminal). |
CommandPatternList | macOS-specific one-liner traits (pbpaste|base64 -D|curl ... | sh). |
AllowListedDevUsers | Developers/automation accounts expected to run such commands. |