{"id":"179b3686-6271-4d87-807d-17d843a8af73","title":"Suspicious Filename with Embedded Base64 Commands","description":"Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\nThese filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\n","author":"@kostastsale","status":"experimental","level":"high","date":"2025-11-22","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1027"],"technique_ids":["T1027","T1059.004"],"logsource":{"product":"linux","category":"file_event"},"falsepositives":["Legitimate files with similar naming patterns (very unlikely)."],"references":["https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/"],"source_path":"rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml","source_sha256":"eb51bc041d739889ecbd52c5a3aa9e44e9d034fa123596cbb1c0b4b1d26edf28","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Filename with Embedded Base64 Commands\nid: 179b3686-6271-4d87-807d-17d843a8af73\nstatus: experimental\ndescription: |\n    Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\n    These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\nreferences:\n    - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/\nauthor: '@kostastsale'\ndate: 2025-11-22\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.004\n    - attack.t1027\nlogsource:\n    product: linux\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|contains:\n            - '{echo'\n            - '{base64,-d}'\n    condition: selection\nfalsepositives:\n    - Legitimate files with similar naming patterns (very unlikely).\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/179b3686-6271-4d87-807d-17d843a8af73.json","kind":"sigma"}