Techniques › T1036.006 › AN0813
AN0813 Analytic 0813
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of renamed or dropped files with a trailing space to deceive users or analysts, especially in LaunchAgents or LaunchDaemons.</p>
- Detects
- T1036.006 Space after Filename
- Part of
- DET0292 Masquerading via Space After Filename - Behavioral Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | process events | DC0032 Process Creation |
| fs:fsusage | filesystem activity | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
FilenamePattern | Tunable regex or path rule to match common masquerade attempts (e.g., 'Terminal .app'). |
TargetPath | Analytic can be scoped to key directories (e.g., /Users/Library/LaunchAgents/). |
UserContext | Focus detection on suspicious user sessions or service creation under non-admin users. |