What is Long UNC filename spoofing and how does it enable catalog signature forgery?
Long UNC filename spoofing exploits paths with a trailing space (e.g., `\\?\C:\Windows\System32\calc.exe `) to trick Windows into treating the file as a different target. When you `type` a payload into such a path, the system copies the file attributes—including the catalog signature—from the legitimate file in the same directory. This technique, detailed in Catalog Signature Forgery - Long UNC Filename Spoofing, allows an attacker to forge a trusted Microsoft signature without modifying the original file's digital signature.
Long UNCcatalog signature forgeryfilename spoofingsignature spoofing