Linux File Creation with Unusually Long Filenames (100+ Characters)

Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.

FreeReviewedSigma · Low · v5

Product: linux
Category: file_event
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2025-11-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the target filename ends with at least 100 characters, which can be used to hinder analysis or evade simpler pattern-based detections. Attackers may choose long, irregular filenames to make malicious artifacts harder to locate and classify. It relies on Linux file event telemetry that provides the full TargetFilename and supports filtering out specific known benign path prefixes.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Linux File Creation with Unusually Long Filenames (100+ Characters)

Pivot detection · T1027 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-file-creation-long-filename-pattern-100-chars-excluding-known-system-paths-11629c4d

title: Linux File Creation with Unusually Long Filenames (100+ Characters)
id: 20af402b-efb2-4a38-a6d2-727bf2d760f3
status: experimental
description: This rule flags file creation events where the target filename ends with at least 100 characters, which can be used to hinder analysis or evade simpler pattern-based detections. Attackers may choose long, irregular filenames to make malicious artifacts harder to locate and classify. It relies on Linux file event telemetry that provides the full TargetFilename and supports filtering out specific known benign path prefixes.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
  - detection.threat-hunting
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|re: "[^/]{100,}$"
  filter_optional_known_good:
    TargetFilename|startswith:
      - /run/systemd/units/invocation:systemd-fsck@
      - /sys/firmware/
      - /var/log/journal/
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate files with long filenames.
level: low
license: DRL-1.1
related:
  - id: 11629c4d-0fe6-465b-be62-b39a1c442aad
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL