LoFP LoFP / mistyped commands or legitimate binaries named to match the pattern

Techniques

Sample rules

Space After Filename - macOS

Description

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

Detection logic

condition: 1 of selection*
selection1:
  CommandLine|endswith: ' '
selection2:
  Image|endswith: ' '