Space after Filename

Data Sources

Required Tables

False Positives

• Users accidentally adding trailing spaces when renaming files (rare but possible)
• File synchronization tools that may preserve trailing spaces from other operating systems
• Automated file processing systems that generate files with improperly trimmed names

Data Sources

Required Sourcetypes

False Positives

• Users accidentally adding trailing spaces when renaming files
• File synchronization tools preserving trailing spaces from other operating systems
• Automated file processing systems generating files with improperly trimmed names

Data Sources

Required Tables

False Positives

• Poorly written scripts or legacy software that accidentally appends whitespace to filenames during file creation or download operations
• File synchronization tools (rsync, Dropbox, OneDrive) that preserve trailing spaces from source systems with different filesystem semantics
• Automated test harnesses or CI pipelines that programmatically generate filenames with trailing spaces as part of edge-case testing

Data Sources

Required Tables

False Positives

• Automated file ingestion pipelines from third-party vendors that fail to sanitize whitespace from filenames before writing to disk
• Cross-platform file transfers (Windows SMB to macOS/Linux NFS) where Windows NTFS allows trailing spaces but the receiving system interprets the filename differently
• Security research or red team tooling in authorized test environments generating intentionally malformed filenames

Data Sources

Required Tables

False Positives

• File download managers or browser extensions that temporarily write partially downloaded files with malformed names before renaming to the final filename
• Backup restoration software that preserves exact byte sequences from backup archives, including any trailing whitespace in originally stored filenames
• Developer toolchains on macOS (Xcode, Homebrew scripts) that generate intermediate build artifacts with non-standard naming conventions

Data Sources

Required Tables

False Positives

• Third-party file sync clients that improperly encode Unicode whitespace characters in filenames when syncing from cloud storage services
• Automated penetration testing frameworks (Atomic Red Team, Caldera) running authorized T1036.006 simulation tests in detection validation environments
• Legacy macOS applications using outdated Cocoa file APIs that append whitespace to filenames as part of temporary file handling

Data Sources

Required Tables

False Positives

• CrowdStrike Falcon sensor itself or other EDR products creating quarantine copies of suspicious files that preserve the original malformed filename
• macOS Time Machine or other backup agents that preserve exact filesystem metadata including trailing spaces when creating backup snapshots
• Cross-compiled toolchains or package managers (MacPorts, Homebrew) that generate intermediate build files with non-sanitized filename strings derived from build manifests