Masquerading Space After Filename
editMasquerading Space After Filename
editThis rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it’s true filetype instead of it’s extension. Adversaries can hide a program’s true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it’s double-clicked.
Rule type: eql
Rule indices:
- auditbeat-*
- logs-endpoint.events.*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- OS: Linux
- OS: macOS
- Use Case: Threat Detection
- Tactic: Defense Evasion
Version: 3
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guide
editRule query
editprocess where host.os.type:("linux","macos") and
event.type == "start" and
(process.executable regex~ """/[a-z0-9\s_\-\\./]+\s""") and not
process.name in ("ls", "find", "grep", "xkbcomp")
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Masquerading
- ID: T1036
- Reference URL: https://attack.mitre.org/techniques/T1036/
-
Sub-technique:
- Name: Space after Filename
- ID: T1036.006
- Reference URL: https://attack.mitre.org/techniques/T1036/006/