Linux File Events: Suspicious Filenames Embedding Base64-Decoded Bash Commands

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

FreeUnreviewedSigmahighv1

linux-file-events-suspicious-filenames-embedding-base64-decoded-bash-commands-179b3686

title: "Linux File Events: Suspicious Filenames Embedding Base64-Decoded Bash Commands"
id: 64dd33b6-c831-478d-8631-45567b2cc884
status: experimental
description: This rule flags Linux file creation or modification events where the filename contains patterns consistent with embedded Base64 command execution in bash, specifically strings like "{echo" and "{base64,-d}". Attackers may hide payloads inside filenames to trigger unintended command interpretation when downstream tooling or scripts process those files. The detection relies on file event telemetry that includes the full target filename.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - "{echo"
      - "{base64,-d}"
  condition: selection
falsepositives:
  - Legitimate files with similar naming patterns (very unlikely).
level: high
license: DRL-1.1
related:
  - id: 179b3686-6271-4d87-807d-17d843a8af73
    type: derived

What it detects

This rule flags Linux file creation or modification events where the filename contains patterns consistent with embedded Base64 command execution in bash, specifically strings like "{echo" and "{base64,-d}". Attackers may hide payloads inside filenames to trigger unintended command interpretation when downstream tooling or scripts process those files. The detection relies on file event telemetry that includes the full target filename.

Known false positives

Legitimate files with similar naming patterns (very unlikely).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.