macOS Process Creation with Trailing Space in Filename
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.
Sigma
