File dropped into spoofed 'C:\Windows \SysWOW64' path with trailing space

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•1

This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.