Space after Filename is ATT&CK T1036.006, a Stealth technique for Linux and macOS. It abuses how the operating system decides how to handle a file when the name ends in a space.
How attackers use it
MITRE walks through an example. Suppose a Mach-O executable called evil.bin is double clicked: it launches Terminal.app and runs. Rename it to evil.txt and a double click opens the default text editor instead, so the binary does not run. Now rename it to evil.txt followed by a trailing space. When a user double clicks that file, the true file type is determined by the OS and the binary executes. MITRE notes that this does not work with .app extensions.
The attacker gets a file that looks like a text file or an image in a listing but behaves like a program. Procedure examples include one malware family that puts a space after a false .jpg extension so that execution runs through Terminal.app, and a group that put several spaces before a file extension to avoid suspicion.
How to detect it
The MITRE analytics look for execution where the file name contains a trailing space, including renamed or dropped files with a trailing space used in LaunchAgents or LaunchDaemons. The page also points out that command line interpreters treat file names with trailing whitespace in particular ways.
Process creation logs that show the full command line with quoting are the most useful source. A name that ends in whitespace is easy to miss in plain text, so search for it explicitly.
To find files whose names end in a space under the current folder, a read-only check for Linux and macOS:
find . -name "* " -type f -ls
How to reduce the risk
MITRE lists no dedicated mitigations for this sub-technique. Sensible defensive steps are to scan download and temp folders for file names that end in whitespace, make sure mail and web gateways inspect file content instead of only extensions, and teach people that a file that opens a terminal window is not a picture.
