macOS Process Command-Line and Image With Trailing Space After Filename

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

FreeUnreviewedSigmalowv1

macos-process-command-line-and-image-with-trailing-space-after-filename-b6e2a2e3

title: macOS Process Command-Line and Image With Trailing Space After Filename
id: cf0ccb7b-66c5-4250-8acd-00d4c55cf105
status: test
description: This rule flags macOS process creation events where the command line and the executable image path both end with a trailing space. Attackers may use trailing spaces to masquerade as legitimate filenames or bypass casual string matching in tools and reviews. Detection relies on process creation telemetry that includes the full command line and the image path, specifically whether each field ends with a single space.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.006/T1036.006.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_space_after_filename.yml
author: remotephone, Huntrule Team
date: 2021-11-20
modified: 2023-01-04
tags:
  - attack.stealth
  - attack.t1036.006
logsource:
  product: macos
  category: process_creation
detection:
  selection1:
    CommandLine|endswith: " "
  selection2:
    Image|endswith: " "
  condition: 1 of selection*
falsepositives:
  - Mistyped commands or legitimate binaries named to match the pattern
level: low
license: DRL-1.1
related:
  - id: b6e2a2e3-2d30-43b1-a4ea-071e36595690
    type: derived

What it detects

This rule flags macOS process creation events where the command line and the executable image path both end with a trailing space. Attackers may use trailing spaces to masquerade as legitimate filenames or bypass casual string matching in tools and reviews. Detection relies on process creation telemetry that includes the full command line and the image path, specifically whether each field ends with a single space.

Known false positives

Mistyped commands or legitimate binaries named to match the pattern

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.