AN0812
Analytic 0812
Linux
Detection of file execution where the file name contains a trailing space to masquerade as a known executable. Adversaries may exploit the way command line interpreters handle file names with trailing whitespace.
auditd:SYSCALL
execve
linux:syslog
application or system execution logs
[ExecutableNameTrailingSpace]
This detection may vary based on how different shells and file systems treat trailing spaces. Normalize or regex-match file names with trailing space.
[UserContext]
Monitor for untrusted or lower-privileged users executing suspicious scripts with disguised names.
[TimeWindow]
Tune for execution patterns during off-hours to reduce false positives.
AN0813
Analytic 0813
macOS
Execution of renamed or dropped files with a trailing space to deceive users or analysts, especially in LaunchAgents or LaunchDaemons.
macos:unifiedlog
process events
fs:fsusage
filesystem activity
[FilenamePattern]
Tunable regex or path rule to match common masquerade attempts (e.g., 'Terminal .app').
[TargetPath]
Analytic can be scoped to key directories (e.g., /Users/Library/LaunchAgents/).
[UserContext]
Focus detection on suspicious user sessions or service creation under non-admin users.