Query: detection rule: Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe
Matching passage: Sigma rule: Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processe. Logsource: linux / file_event. Rule: title: Suspicious Filename with Embedded Base64 Commands id: 179b3686-6271-4d87-807d-17d843a8af73 status: experimental description: 'Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns. ' references: - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/ author: '@kostastsale' date: 2025-11-22 tags: - attack.execution - attack.stealth - attack.t1059.004 - attack.t1027 logsource: product: linux category: file_event detection: selection: TargetFilename|contains: - '{echo' - '{base64,-d}' condition: selection falsepositives: - Legitimate files with similar naming patterns (very unlikely). level: high
Near-miss passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" fla. Logsource: windows / process_creation. Rule: title: Change PowerShell Policies to an Insecure Level id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 61d0475c-173f-4844-86f7-f3eebae1c66b type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/ author: frack113 date: 2021-11-01 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe selection_option: CommandLine|contains: - '-executionpolicy ' - ' -ep ' - ' -exec ' selection_level: CommandLine|contains: - Bypass - Unrestricted filter_main_powershell_core: ParentImage: - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\msiexec.exe CommandLine|contains: - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\PowerShell\7\ - -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files (x86)\PowerShell\7\ filter_optional_avast: ParentImage|contains: - C:\Program Files\Avast Software\Avast\ - C:\Program Files (x86)\Avast Software\Avast\ - \instup.exe CommandLine|contains: - -ExecutionPolicy ByPass -File "C:\Program Files\Avast Software\Avast - -ExecutionPolicy ByPass -File "C:\Program Files (x86)\Avast Software\Avast\ condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrator scripts level: medium