Space After Filename in Command Execution
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
Sigma
