Sigma rule: Suspicious Filename with Embedded Base64 Commands

Rule

Title

Suspicious Filename with Embedded Base64 Commands

Status

experimental

Level

high

Author

@kostastsale

Date

2025-11-22

File

rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Log source

product

linux

category

file_event

Detection

selection:
    TargetFilename|contains:
        - '{echo'
        - '{base64,-d}'
condition: selection

False positives (as the rule lists them)

• Legitimate files with similar naming patterns (very unlikely).

Tags

• attack.execution
• attack.stealth
• attack.t1059.004
• attack.t1027

MITRE ATT&CK ids this rule names

• T1027
• T1059.004

References

• https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml