Masquerading: Space after Filename `T1036.006`

Tactic: Stealth

Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Image`	2	`ends_with` 1, `regex_match` 1	, `/[a-z0-9\s_\-\\./]+\s`
`event.type`	2	`eq` 2	`start`
`CommandLine`	1	`ends_with` 1
`EventType`	1	`in` 1	`exec`, `exec_event`, `executed`
`host.os.type`	1	`eq` 1
`process_name`	1	`ends_with` 1

Top indicator values (9 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticMasquerading Space After Filename elasticProcesses with Trailing Spaces	2	1087
`CommandLine`	`ends_with`	sigmaSpace After Filename - macOS	1
`EventType`	`in`	`exec` elasticProcesses with Trailing Spaces	1	206
`EventType`	`in`	`exec_event` elasticProcesses with Trailing Spaces	1	150
`EventType`	`in`	`executed` elasticProcesses with Trailing Spaces	1	98
`EventType`	`in`	`process_started` elasticProcesses with Trailing Spaces	1	83
`Image`	`ends_with`	sigmaSpace After Filename - macOS	1
`Image`	`regex_match`	`/[a-z0-9\s_\-\\./]+\s` elasticMasquerading Space After Filename	1
`process_name`	`ends_with`	elasticProcesses with Trailing Spaces	1

Exclusions (12 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`starts_with`	`/opt/gitlab/sv/gitlab-exporter/` elasticMasquerading Space After Filename	1
`Image`	`starts_with`	`/opt/nessus_agent/` elasticMasquerading Space After Filename	1
`Image`	`starts_with`	`/tmp/ansible-admin/` elasticMasquerading Space After Filename	1
`process.args`	`eq`	`runc` elasticMasquerading Space After Filename	1
`process.parent.args`	`in`	`./check_rubrik` elasticMasquerading Space After Filename	1
`process.parent.args`	`in`	`/etc/rubrik/start_stop_agent.sh` elasticMasquerading Space After Filename	1
`process.parent.args`	`in`	`/etc/rubrik/start_stop_bootstrap.sh` elasticMasquerading Space After Filename	1
`process.parent.args`	`in`	`/usr/bin/check_mk_agent` elasticMasquerading Space After Filename	1
`process_name`	`in`	`find` elasticMasquerading Space After Filename	1
`process_name`	`in`	`grep` elasticMasquerading Space After Filename	1
`process_name`	`in`	`ls` elasticMasquerading Space After Filename	1
`process_name`	`in`	`xkbcomp` elasticMasquerading Space After Filename	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Sigma 1 rule

Space After Filename - macOS

Masquerading: Space after Filename T1036.006