Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1036.006_space-after-filename
Adversaries can hide a program's true filetype by changing the extension of a file.
Passed 19 of 22 test cases with the skill, and 7 of 22 without it.
and 14 more in the full report
12 fixed7 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
We want to run Atomic Red Team Test 1 for space after filename masquerading. What platform does Test 1 specifically target, and is it designed as an automated shell script or a manual test?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies macOS as the supported platform for Atomic Test 1. | Passed | Passed |
| Identifies Atomic Test 1 as a manual test. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1036
Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed .
Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Platforms: Linux, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Space After Filename
Supported Platforms: macos
Space after filename.
test cases passed, vs 7 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.