APT38G0082 ↗
Has put several spaces before a file extension to avoid detection and suspicion.1
- Tactic
- Stealth
- Platforms
- Linux, macOS
- Version
- 2.0
- Created
- 10 February 2020
- Last modified
- 12 May 2026
- Contributor
- Erye Hernandez, Palo Alto Networks
Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Space after Filename MITRE reference T1036.006
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
KeydnapS0276 ↗
Puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.1
All 1 software entries for this technique
Offense vs defense T1036.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2021 Q4Space after Filename detection strategy DET0292
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Masquerading via Space After Filename - Behavioral Detection Strategy
2 platforms
AN0812 · Linux
Detection of file execution where the file name contains a trailing space to masquerade as a known executable. Adversaries may exploit the way command line interpreters handle file names with trailing whitespace.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File MetadataDC0059 | linux:syslog | application or system execution logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutableNameTrailingSpace | This detection may vary based on how different shells and file systems treat trailing spaces. Normalize or regex-match file names with trailing space. |
| UserContext | Monitor for untrusted or lower-privileged users executing suspicious scripts with disguised names. |
| TimeWindow | Tune for execution patterns during off-hours to reduce false positives. |
AN0813 · macOS
Execution of renamed or dropped files with a trailing space to deceive users or analysts, especially in LaunchAgents or LaunchDaemons.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process events |
| File AccessDC0055 | fs:fsusage | filesystem activity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenamePattern | Tunable regex or path rule to match common masquerade attempts (e.g., 'Terminal .app'). |
| TargetPath | Analytic can be scoped to key directories (e.g., /Users/Library/LaunchAgents/). |
| UserContext | Focus detection on suspicious user sessions or service creation under non-admin users. |
Tests2Executorsmanual 1 · sh 1Need elevation0 of 2Have prerequisites0Have cleanup1Platformsmacos, linux
Tests from Atomic Red Team (MIT licence) · technique definition