This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Malware - Prevented - Elastic Endgame Microsoft 365 Exchange Anti-Phish Policy Deletion »
Elastic Docs ›Elastic Security Solution [master] ›Detections and alerts ›Prebuilt rule reference

Masquerading Space After Filename

edit

Masquerading Space After Filename

edit

This rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it’s true filetype instead of it’s extension. Adversaries can hide a program’s true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it’s double-clicked.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Linux
  • macOS
  • Threat Detection
  • Defense Evasion

Version: 1

Added (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit











Rule query
edit








process where host.os.type:("linux","macos") and event.type ==
"start" and (process.executable regex~ """/[a-z0-9\s_\-\\./]+\s""")
and not process.name in ("ls", "find", "grep", "xkbcomp")











Threat mapping
edit




Framework: MITRE ATT&CKTM
















« Malware - Prevented - Elastic Endgame


Microsoft 365 Exchange Anti-Phish Policy Deletion »