Linux File Creation: Long Filename Pattern (100+ chars) Excluding Known System Paths

Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.

FreeUnreviewedSigmalowv1

linux-file-creation-long-filename-pattern-100-chars-excluding-known-system-paths-11629c4d

title: "Linux File Creation: Long Filename Pattern (100+ chars) Excluding Known System Paths"
id: 20af402b-efb2-4a38-a6d2-727bf2d760f3
status: experimental
description: This rule flags Linux file creation events where the target filename is at least 100 characters long, excluding known benign system-related filename prefixes. Attackers may use long filenames to hinder analysis, evade simple matching, or disguise payloads within filesystem artifacts. It relies on file event telemetry that includes the created file path (TargetFilename) and applies length-based matching plus optional exclusions for common legitimate locations.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
  - detection.threat-hunting
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|re: "[^/]{100,}$"
  filter_optional_known_good:
    TargetFilename|startswith:
      - /run/systemd/units/invocation:systemd-fsck@
      - /sys/firmware/
      - /var/log/journal/
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate files with long filenames.
level: low
license: DRL-1.1
related:
  - id: 11629c4d-0fe6-465b-be62-b39a1c442aad
    type: derived

What it detects

This rule flags Linux file creation events where the target filename is at least 100 characters long, excluding known benign system-related filename prefixes. Attackers may use long filenames to hinder analysis, evade simple matching, or disguise payloads within filesystem artifacts. It relies on file event telemetry that includes the created file path (TargetFilename) and applies length-based matching plus optional exclusions for common legitimate locations.

Known false positives

Legitimate files with long filenames.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.