Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

FreeReviewedSigma · High · v3

Product: linux
Category: file_event
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2025-11-22
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux file events where the filename contains specific substrings indicative of embedded Base64 decoding and bash-style command fragments. Such naming can be used to smuggle shell commands into workflows that later process filenames, enabling stealthy execution of hidden payloads. It relies on file event telemetry that includes the full target filename and matches the presence of the defined suspicious markers within that name.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

Suspicious Base64 Decoded Payload Piped to Shell

Linux File Creation with Unusually Long Filenames (100+ Characters)

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

Malicious Download Piped to Shell via curl or wget (via process_creation)

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Pivot detection · T1027 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-file-events-suspicious-filenames-embedding-base64-decoded-bash-commands-179b3686

title: "Linux File Creation: Filename Contains Embedded Base64 Bash Fragments"
id: 64dd33b6-c831-478d-8631-45567b2cc884
status: experimental
description: This rule flags Linux file events where the filename contains specific substrings indicative of embedded Base64 decoding and bash-style command fragments. Such naming can be used to smuggle shell commands into workflows that later process filenames, enabling stealthy execution of hidden payloads. It relies on file event telemetry that includes the full target filename and matches the presence of the defined suspicious markers within that name.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - "{echo"
      - "{base64,-d}"
  condition: selection
falsepositives:
  - Legitimate files with similar naming patterns (very unlikely).
level: high
license: DRL-1.1
related:
  - id: 179b3686-6271-4d87-807d-17d843a8af73
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL