Techniques › T1036.006 › AN0812
AN0812 Analytic 0812
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of file execution where the file name contains a trailing space to masquerade as a known executable. Adversaries may exploit the way command line interpreters handle file names with trailing whitespace.</p>
- Detects
- T1036.006 Space after Filename
- Part of
- DET0292 Masquerading via Space After Filename - Behavioral Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| linux:syslog | application or system execution logs | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ExecutableNameTrailingSpace | This detection may vary based on how different shells and file systems treat trailing spaces. Normalize or regex-match file names with trailing space. |
UserContext | Monitor for untrusted or lower-privileged users executing suspicious scripts with disguised names. |
TimeWindow | Tune for execution patterns during off-hours to reduce false positives. |