t1036-006-space-after-filename

name	T1036.006_space-after-filename
description	Adversaries can hide a program's true filetype by changing the extension of a file.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1036.006","defense-evasion","linux","macos","sub-technique"]
technique_id	T1036.006
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","macOS"]
mitre_url	https://attack.mitre.org/techniques/T1036/006
tech_stack	["linux","macos"]
cwe_ids	["CWE-693"]
chains_with	["T1036","T1036.001","T1036.002","T1036.003","T1036.004","T1036.005","T1036.007","T1036.008","T1036.009","T1036.010","T1036.011","T1036.012"]
prerequisites	["T1036"]
severity_boost	{"T1036":"Chain with T1036 for deeper attack path","T1036.001":"Chain with T1036.001 for deeper attack path","T1036.002":"Chain with T1036.002 for deeper attack path"}

T1036.006 Space after Filename

Sub-technique of: T1036

High-Level Description

Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed .

Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS

What to Check

• Identify if Space after Filename technique is applicable to target environment
• Check Linux systems for indicators of Space after Filename
• Check macOS systems for indicators of Space after Filename
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Space After Filename (Manual)

Space After Filename

Supported Platforms: macos

Atomic Test 2: Space After Filename

Space after filename.

Supported Platforms: macos, linux

mkdir -p /tmp/atomic-test-T1036.006
cd /tmp/atomic-test-T1036.006
mkdir -p 'testdirwithspaceend '
[ "$(uname)" =  ] && /bin/echo  >  &&   >>  &&   >>  || /usr/bin/echo -e  | ed  >/dev/null
 +x