Linux File Creation with Unusually Long Filenames (100+ Characters)

Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.

FreeReviewedSigma · Low · v5

Product: linux
Category: file_event
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2025-11-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the target filename ends with at least 100 characters, which can be used to hinder analysis or evade simpler pattern-based detections. Attackers may choose long, irregular filenames to make malicious artifacts harder to locate and classify. It relies on Linux file event telemetry that provides the full TargetFilename and supports filtering out specific known benign path prefixes.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

Suspicious Base64 Decoded Payload Piped to Shell

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

Malicious Download Piped to Shell via curl or wget (via process_creation)

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

Linux File Creation with Unusually Long Filenames (100+ Characters)

Pivot detection · T1027 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-file-creation-long-filename-pattern-100-chars-excluding-known-system-paths-11629c4d

title: Linux File Creation with Unusually Long Filenames (100+ Characters)
id: 20af402b-efb2-4a38-a6d2-727bf2d760f3
status: experimental
description: This rule flags file creation events where the target filename ends with at least 100 characters, which can be used to hinder analysis or evade simpler pattern-based detections. Attackers may choose long, irregular filenames to make malicious artifacts harder to locate and classify. It relies on Linux file event telemetry that provides the full TargetFilename and supports filtering out specific known benign path prefixes.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
  - detection.threat-hunting
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|re: "[^/]{100,}$"
  filter_optional_known_good:
    TargetFilename|startswith:
      - /run/systemd/units/invocation:systemd-fsck@
      - /sys/firmware/
      - /var/log/journal/
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate files with long filenames.
level: low
license: DRL-1.1
related:
  - id: 11629c4d-0fe6-465b-be62-b39a1c442aad
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL