T1036.006_space-after-filename

T1036.006 Space after Filename

Sub-technique of: T1036

High-Level Description

Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed .

Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS

What to Check

• Identify if Space after Filename technique is applicable to target environment
• Check Linux systems for indicators of Space after Filename
• Check macOS systems for indicators of Space after Filename
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Space After Filename (Manual)

Space After Filename

Supported Platforms: macos

Atomic Test 2: Space After Filename

Space after filename.

Supported Platforms: macos, linux

mkdir -p /tmp/atomic-test-T1036.006
cd /tmp/atomic-test-T1036.006
mkdir -p 'testdirwithspaceend '
[ "$(uname)" = 'FreeBSD' ] && /bin/echo "#\!/bin/sh" > "testdirwithspaceend /init " && echo 'echo "print(\"running T1035.006 with space after filename to masquerade init\")" | python3.9' >> "testdirwithspaceend /init " && echo "exit" >> "testdirwithspaceend /init " || /usr/bin/echo -e "%d\na\n#!/usr/bin/perl\nprint \"running T1035.006 with space after filename to masquerade init\\n\";\nqx/cp \/usr\/bin\/perl 'init  '/;\nqx/'.\/init  ' -e 'sleep 5'/;\n.\nwq\n" | ed 'testdirwithspaceend /init ' >/dev/null
chmod +x 'testdirwithspaceend /init '
'./testdirwithspaceend /init '

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Space after Filename by examining the target platforms (Linux, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1036.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Masquerading via Space After Filename - Behavioral Detection Strategy

Risk Assessment

CWE Categories

References

• Mac Backdoors are back
• Atomic Red Team - T1036.006
• MITRE ATT&CK - T1036.006