Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

FreeReviewedSigma · High · v3

Product: linux
Category: file_event
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2025-11-22
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux file events where the filename contains specific substrings indicative of embedded Base64 decoding and bash-style command fragments. Such naming can be used to smuggle shell commands into workflows that later process filenames, enabling stealthy execution of hidden payloads. It relies on file event telemetry that includes the full target filename and matches the presence of the defined suspicious markers within that name.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Linux File Creation with Unusually Long Filenames (100+ Characters)

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Pivot detection · T1027 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-file-events-suspicious-filenames-embedding-base64-decoded-bash-commands-179b3686

title: "Linux File Creation: Filename Contains Embedded Base64 Bash Fragments"
id: 64dd33b6-c831-478d-8631-45567b2cc884
status: experimental
description: This rule flags Linux file events where the filename contains specific substrings indicative of embedded Base64 decoding and bash-style command fragments. Such naming can be used to smuggle shell commands into workflows that later process filenames, enabling stealthy execution of hidden payloads. It relies on file event telemetry that includes the full target filename and matches the presence of the defined suspicious markers within that name.
references:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml
author: "@kostastsale, Huntrule Team"
date: 2025-11-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.004
  - attack.t1027
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - "{echo"
      - "{base64,-d}"
  condition: selection
falsepositives:
  - Legitimate files with similar naming patterns (very unlikely).
level: high
license: DRL-1.1
related:
  - id: 179b3686-6271-4d87-807d-17d843a8af73
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL