Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

MediumElastic detection rules

Command Line Obfuscation via Whitespace Padding

Identifies process execution events where the command line value contains a long sequence of whitespace characters or multiple occurrences of contiguous whitespace. Attackers may attempt to evade signature-based detections by padding their malicious command with unnecessary whitespace characters. These observations should be investigated for malicious behavior.

ATT&CK coverage

Execution

T1059Command and Scripting Interpreter450 detections cover this technique
- T1059.001PowerShell 354 detections cover this technique

Stealth

T1027Obfuscated Files or Information144 detections cover this technique
- T1027.010Command Obfuscation 33 detections cover this technique
T1140Deobfuscate/Decode Files or Information 56 detections cover this technique

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Elastic
Licence: Elastic License 2.0Read the licence
Published: Aug 27, 2026
Version: 1