T1036.006 — Space after Filename

Tactic: Stealth · Platforms: Linux, macOS

Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a…

Sub-technique of Masquerading (T1036).

Sigma detection rules (2)

T1036.006 Masquerading: Space after Filename

title: "T1036.006 Masquerading: Space after Filename"
id: babc0952-db4e-437c-8864-ed1c5cdb23e6
description: 'Space after Filename is a macOS Finder/LaunchServices filetype-resolution trick (trailing space in a filename changes how Launch Services resolves the file type on double-click); Linux has no equivalent extension-based launch resolution, so this technique does not apply to Linux at all. Retargeted to the closest defensible Linux-observable proxy: file creation events (auditd PATH CREATE) where the created filename itself ends in whitespace, which is at best a weak naming-anomaly signal and carries no functional masquerading effect on Linux. Tune using: ExecutableNameTrailingSpace, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1036/006
author: Shahrukh Khan
date: 2026-06-20
license: MIT
tags:
  - attack.stealth
  - attack.t1036.006

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|re: '.*\s
    
  


  condition: selection

falsepositives:
  - This technique is macOS-specific (Finder/LaunchServices filetype resolution); Linux has no equivalent mechanism, so this rule is a naming-anomaly proxy only, not a real masquerading detection. Trailing-whitespace filenames can also arise benignly from scripted downloads or copy-paste errors in filenames.

level: informational

T1036.006 Masquerading: Space after Filename

title: "T1036.006 Masquerading: Space after Filename"
id: ad4144fc-fdc1-4caa-98e4-c53bbafefc46
description: 'Masquerading via Space After Filename - Behavioral Detection Strategy. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilenamePattern, TargetPath, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1036/006
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.stealth
  - attack.t1036.006

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|re: '.* \.(pdf|docx|txt) 
    
  


  condition: selection

falsepositives:
  - Rare legitimate file paths containing trailing whitespace created by automated export tools.

level: medium

Related sub-techniques

Explore