Space After Filename - macOS

Title: Space After Filename - macOS
Status: test
Description:Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.006/T1036.006.md
Author: remotephone
Date: 2021-11-20
modified:2023-01-04
Tags:

• -'attack.stealth'
• -'attack.t1036.006'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection1:
    CommandLine|endswith: ' '
  selection2:
    Image|endswith: ' '
  condition:1 of selection*
Falsepositives:
  -Mistyped commands or legitimate binaries named to match the pattern
Level: low