Skip to content

Commit 180c80e

Browse files
Apply suggestions from code review
1 parent 2bdd914 commit 180c80e

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

rules/linux/file_event/file_event_lnx_vshell_filename_exec.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
1-
title: Malicious Filename with Embedded Base64 Commands - VShell
1+
title: Malicious Filename with Embedded Base64 Commands
22
id: 179b3686-6271-4d87-807d-17d843a8af73
33
status: experimental
4-
description: Detects files with maliciously crafted filenames containing embedded Base64-encoded bash commands, associated with VShell malware campaigns
4+
description: |
5+
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
6+
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
57
references:
68
- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
79
author: '@kostastsale'

0 commit comments

Comments
 (0)