Sigma rule: Potentially Suspicious Long Filename Pattern - Linux

Rule

Title

Potentially Suspicious Long Filename Pattern - Linux

Status

experimental

Level

low

Author

@kostastsale

Date

2025-11-22

File

rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
Adjust the threshold of filename length as needed based on your environment.

Log source

product

linux

category

file_event

Detection

selection:
    TargetFilename|re: '[^/]{100,}$'
filter_optional_known_good:
    TargetFilename|startswith:
        - '/run/systemd/units/invocation:systemd-fsck@'
        - '/sys/firmware/'
        - '/var/log/journal/'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate files with long filenames.

Tags

• attack.execution
• attack.stealth
• attack.t1059.004
• attack.t1027
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1027
• T1059.004

References

• https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml