Process executed from a filename with a trailing space

Siemphony@siemphonymediumT1036.006unverified

AN0812 asks for "file execution where the file name contains a trailing space to masquerade as a known executable," citing how command-line interpreters handle trailing whitespace differently from the GUI dispatch behaviour the technique is best known for on macOS. This rule takes the literal, single-event form of that claim on the {category: process_creation, product: linux} logsource — the same raw-auditd-normalised shape (Image, CommandLine) used throughout this corpus — and matches an executed `Image` whose resolved path ends in a literal space character. `Image` is the auditd pipeline's resolved absolute path of the file that was actually execve'd, so this reads the real, on-disk filename rather than however it was quoted on a command line, which is the more literal reading of the technique: the file's own name carries the trailing space, not the way it was invoked. This is deliberately narrow and says nothing about *why* a trailing space would help an adversary on Linux specifically — unlike macOS's Finder, Linux has no extension-based double-click dispatch for this to bypass, and MITRE's own description is written primarily around that macOS mechanism; AN0812's own text frames the Linux angle as evading a command-line interpreter or a naive extension check rather than an exec reroute, and this rule only asserts the checkable fact — a trailing-space filename was executed — not the more specific evasion story. Two of MITRE's three knobs go unpopulated: ExecutableNameTrailingSpace *is* the selector below, so there is nothing further to add; TimeWindow, aimed at flagging off-hours execution to cut noise, needs a time-of-day comparison lib/sigma has no function for, so it is not attempted; and UserContext (untrusted or lower-privileged users) is left to the reviewer, since a blanket privilege filter here would need a per-estate notion of "untrusted" this brief does not supply. The second Linux logsource in the same analytic, {product: linux, service: syslog}, is not attempted: no rule in this corpus has an established Sigma field vocabulary for it. AN0813, the macOS leg, is not attempted either: its only logsource, {product: macos, service: unifiedlog}, is unstandardised in this pipeline — the same blocker already recorded against that exact source for T1037.002, T1059.002, T1548.004 and T1546.006 — despite macOS being where MITRE's own narrative example (Finder double-click dispatch) actually applies. Prerequisite: raw auditd does not record execve by default; this returns nothing until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0292, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where FolderPath endswith " "

Splunk · SPL

Run this as a search.

index=* Image="* "

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE TO_LOWER(process.executable) LIKE "* "

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i) $</field>    <description>Process executed from a filename with a trailing space</description>    <mitre>      <id>T1036.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 86016c01-d63d-4cfd-9de3-c1e3f2488e1b

ATT&CKT1036.006

T1036.006Space after Filename

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

A Linux process execution whose resolved Image path ends in a literal space character. AN0812 asks for "file execution where the file name contains a trailing space to masquerade as a known executable," citing how command-line interpreters handle trailing whitespace differently from the GUI double-click dispatch the technique is best known for on macOS. This rule takes the literal, single-event reading of that claim on Linux.

02 · Telemetry you need

category: process_creation, product: linux — the same raw-auditd- normalised shape (Image, CommandLine) used throughout this corpus. Prerequisite the rule states plainly: raw auditd does not record execve by default. This returns nothing until a rule such as -a always,exit -F arch=b64 -S execve -k exec is loaded — zero rows reads as quiet when it actually means blind.

03 · How the logic works

One field, one modifier. Image is the auditd pipeline's resolved absolute path of the file that was actually execve'd, so this reads the real, on-disk filename rather than however it was quoted on a command line — the more literal reading of the technique, since it's the file's own name that carries the trailing space, not the invocation. The description is deliberately narrow about why this matters on Linux: unlike macOS's Finder, Linux has no extension-based double-click dispatch for a trailing space to bypass. MITRE's own description is written primarily around that macOS mechanism; AN0812 frames the Linux angle as evading a command-line interpreter or a naive extension check rather than an exec reroute. This rule only asserts the checkable fact — a trailing-space filename was executed — not the more specific evasion story. MITRE's ExecutableNameTrailingSpace knob is this selector; there is nothing further to populate for it. Two other knobs go unreached: TimeWindow, aimed at flagging off-hours execution, needs a time-of-day comparison lib/sigma has no function for; UserContext (untrusted or lower-privileged users) is left to the reviewer, since a blanket privilege filter needs a per-estate notion of "untrusted" the brief doesn't supply. The syslog leg of the same analytic and AN0813, the macOS leg on unifiedlog, are both declined — no established Sigma field vocabulary for either exists anywhere in this corpus, despite macOS being where MITRE's own narrative example actually applies. A defect a reviewer found and this lesson must flag directly: the review verdict notes that AN0812's own knob description already warns "this detection may vary based on how different shells and file systems treat trailing spaces" and suggests normalizing or regex-matching — a warning the rule's description dismisses as already handled by the selector. But a bare Image|endswith: ' ' silently assumes the trailing space survives untouched from execve through auditd normalization into whatever pipeline populates the Sigma-shaped Image field. Many log shippers and JSON/field-extraction layers right-trim string values as a matter of course, which would strip the one character this entire rule keys on before it ever reaches evaluation. The rule would then validate clean, render in four backends, and match zero rows forever — indistinguishable from "quiet." Confirm the actual normalizer/shipper preserves trailing whitespace verbatim before trusting a zero-hit result as a negative.

04 · Common false positives

A user renaming a file through a GUI file manager who leaves an accidental trailing space, then runs it from a terminal that inherits the exact quoted path. Build or packaging tooling extracting an archive originally created on Windows or macOS, where a file legitimately ends in a trailing space, then a shell script globs and executes without trimming. Filesystem or backup- software test suites that intentionally exercise trailing-space filenames as part of automated coverage.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0292, never run against a log line. Whether the one character this rule depends on survives your pipeline is unknown until checked.
tier_2: starts there, not with tuning the selector.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Verify field-preservation through your actual ingest pipeline first — this is the precondition for any hit meaning anything. Exclude known CI/test-suite paths and build directories. Pair with CommandLine context to distinguish an interactive terminal session from an automated pipeline.

Declared by the author

A user renaming or creating a file through a graphical file manager (GNOME Files, a desktop drag-and-drop) who leaves an accidental trailing space, then runs it from a terminal that inherits the exact quoted path, including the space — an ordinary mistake rather than adversarial activity.
Build or packaging tooling that extracts an archive originally created on Windows or macOS where a file legitimately ends in a trailing space, then a shell script globs for and executes files in that directory without trimming whitespace from the matched names.
Filesystem or backup-software test suites that intentionally exercise trailing-space and other odd-filename edge cases by creating and then running a binary named with a trailing space as part of automated test coverage.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/86016c01-d63d-4cfd-9de3-c1e3f2488e1b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process executed from a filename with a trailing space

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it