Process executed from a filename with a trailing space

1title: Process executed from a filename with a trailing space2id: 86016c01-d63d-4cfd-9de3-c1e3f2488e1b3status: experimental4description: |5  AN0812 asks for "file execution where the file name contains a trailing6  space to masquerade as a known executable," citing how command-line7  interpreters handle trailing whitespace differently from the GUI dispatch8  behaviour the technique is best known for on macOS. This rule takes the9  literal, single-event form of that claim on the {category: process_creation,10  product: linux} logsource — the same raw-auditd-normalised shape (Image,11  CommandLine) used throughout this corpus — and matches an executed `Image`12  whose resolved path ends in a literal space character. `Image` is the13  auditd pipeline's resolved absolute path of the file that was actually14  execve'd, so this reads the real, on-disk filename rather than however it15  was quoted on a command line, which is the more literal reading of the16  technique: the file's own name carries the trailing space, not the way it17  was invoked. This is deliberately narrow and says nothing about *why* a18  trailing space would help an adversary on Linux specifically — unlike19  macOS's Finder, Linux has no extension-based double-click dispatch for this20  to bypass, and MITRE's own description is written primarily around that21  macOS mechanism; AN0812's own text frames the Linux angle as evading a22  command-line interpreter or a naive extension check rather than an exec23  reroute, and this rule only asserts the checkable fact — a trailing-space24  filename was executed — not the more specific evasion story. Two of MITRE's25  three knobs go unpopulated: ExecutableNameTrailingSpace *is* the selector26  below, so there is nothing further to add; TimeWindow, aimed at flagging27  off-hours execution to cut noise, needs a time-of-day comparison lib/sigma28  has no function for, so it is not attempted; and UserContext (untrusted or29  lower-privileged users) is left to the reviewer, since a blanket privilege30  filter here would need a per-estate notion of "untrusted" this brief does31  not supply. The second Linux logsource in the same analytic, {product:32  linux, service: syslog}, is not attempted: no rule in this corpus has an33  established Sigma field vocabulary for it. AN0813, the macOS leg, is not34  attempted either: its only logsource, {product: macos, service: unifiedlog},35  is unstandardised in this pipeline — the same blocker already recorded36  against that exact source for T1037.002, T1059.002, T1548.004 and37  T1546.006 — despite macOS being where MITRE's own narrative example (Finder38  double-click dispatch) actually applies. Prerequisite: raw auditd does not39  record execve by default; this returns nothing until a rule such as40  `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows41  reads as quiet when it actually means blind.42  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0292, not hand-written and not tested by its author. Any lab result is on this rule's own page.43references:44  - https://attack.mitre.org/techniques/T1036/00645  - https://attack.mitre.org/detectionstrategies/DET029246author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)47date: 2026-08-1848tags:49  - attack.defense-evasion50  - attack.t1036.00651logsource:52  category: process_creation53  product: linux54detection:55  selection:56    Image|endswith: ' '57  condition: selection58falsepositives:59  - "A user renaming or creating a file through a graphical file manager (GNOME Files, a desktop drag-and-drop) who leaves an accidental trailing space, then runs it from a terminal that inherits the exact quoted path, including the space — an ordinary mistake rather than adversarial activity."60  - "Build or packaging tooling that extracts an archive originally created on Windows or macOS where a file legitimately ends in a trailing space, then a shell script globs for and executes files in that directory without trimming whitespace from the matched names."61  - "Filesystem or backup-software test suites that intentionally exercise trailing-space and other odd-filename edge cases by creating and then running a binary named with a trailing space as part of automated test coverage."62level: medium