Detect RTLO In File Name

name: Detect RTLO In File Name
id: 468b7e11-d362-43b8-b6ec-7a2d3b246678
version: 13
creation_date: '2023-05-01'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: |
    The following analytic identifies the use of the right-to-left override
    (RTLO) character in file names. It leverages data from the Endpoint.Filesystem datamodel,
    specifically focusing on file creation events and file names containing the RTLO
    character (U+202E). This activity is significant because adversaries use RTLO to
    disguise malicious files as benign by reversing the text that follows the character.
    If confirmed malicious, this technique can deceive users and security tools, leading
    to the execution of harmful files and potential system compromise.
data_source:
    - Sysmon EventID 11
search: |
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
            values(Filesystem.file_create_time) as file_create_time

    from datamodel=Endpoint.Filesystem where Filesystem.file_name!=unknown

    by Filesystem.action Filesystem.dest Filesystem.file_access_time
       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
       Filesystem.user Filesystem.vendor_product

    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | regex file_name = "\\x{202E}"
    | rex field=file_name "(?<RTLO_file_1>.+)(?<RTLO_exist_file>\\x{202E})(?<RTLO_file_2>.+)"
    | eval file_name_with_RTLO=file_name
    | eval file_name=RTLO_file_1.RTLO_file_2
    | fields - RTLO*
    | `detect_rtlo_in_file_name_filter`
how_to_implement: |
    To successfully implement this search you need to be ingesting information
    on process that includes the full command line of the process being launched on
    your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
    confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
    endpoint product.
known_false_positives: |
    Implementation in regions that use right to left in native language.
references:
    - https://attack.mitre.org/techniques/T1036/002/
    - https://resources.infosecinstitute.com/topic/spoof-using-right-to-left-override-rtlo-technique-2/
    - https://www.trendmicro.com/en_us/research/17/f/following-trail-blacktech-cyber-espionage-campaigns.html
drilldown_searches:
    - name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious RTLO detected in $file_name$ on endpoint $dest$ by user $user$.
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Spearphishing Attachments
asset_type: Endpoint
mitre_attack_id:
    - T1036.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.002/outlook_attachment/rtlo_events.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit