Detection rules › Sigma
Potentially Suspicious Long Filename Pattern - Linux
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.004 Command and Scripting Interpreter: Unix Shell |
| Stealth | T1027 Obfuscated Files or Information |
Event coverage
| Provider | Event |
|---|---|
| Sysmon-for-Linux | Event ID 11 |
Rule body yaml
title: Potentially Suspicious Long Filename Pattern - Linux
id: 11629c4d-0fe6-465b-be62-b39a1c442aad
status: experimental
description: |
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
Adjust the threshold of filename length as needed based on your environment.
references:
- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
author: '@kostastsale'
date: 2025-11-22
tags:
- attack.execution
- attack.stealth
- attack.t1059.004
- attack.t1027
- detection.threat-hunting
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|re: '[^/]{100,}$'
filter_optional_known_good:
TargetFilename|startswith:
- '/run/systemd/units/invocation:systemd-fsck@'
- '/sys/firmware/'
- '/var/log/journal/'
condition: selection and not 1 of filter_optional_*
falsepositives:
- Legitimate files with long filenames.
level: low
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_optional_*Stage 1: selection
selection:
TargetFilename|re: '[^/]{100,}$'
Stage 2: not filter_optional_known_good
filter_optional_known_good:
TargetFilename|startswith:
- '/run/systemd/units/invocation:systemd-fsck@'
- '/sys/firmware/'
- '/var/log/journal/'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TargetFilename | starts_with | /run/systemd/units/invocation:systemd-fsck@ |
TargetFilename | starts_with | /sys/firmware/ |
TargetFilename | starts_with | /var/log/journal/ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetFilename | regex_match |
|