Cross-source coverage

T1036.002 / ATT&CK

Masquerading: Right-to-Left Override

9 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.

Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity. RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:PowerShellWinEventLog:Windows Defendermacos:unifiedlogmacos:endpointsecurityfs:quarantineauditd:SYSCALLlinux:osquerydesktop:file_manager

How MITRE says to detect it DET0527

Right-to-Left Override Masquerading Detection via Filename and Execution Context

Windows Analytic 1461

Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Windows Defender Operational

macOS Analytic 1462

Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.

  • macos:unifiedlog subsystem=com.apple.lsd
  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
  • fs:quarantine /var/log/quarantine.log

Linux Analytic 1463

Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.

  • auditd:SYSCALL execve
  • linux:osquery event-based
  • desktop:file_manager nautilus, dolphin, or gvfs logs

View on attack.mitre.org ↗

SigmaHQ/sigma

3 rules
Detection Severity Format
MMC Executing Files with Reversed Extensions Using RTLO Abuse High Sigma
Potential Defense Evasion Via Right-to-Left Override High Sigma
Potential File Extension Spoofing Using Right-to-Left Override High Sigma

Wazuh Core Ruleset

2 rules
Detection Severity Format
Executed suspicious process with right to left override character in binary file, possible malicious file masquerading Critical Wazuh XML
Suspicious process (right to left override character) spawned a subprocess Critical Wazuh XML

splunk/security_content

2 rules
Detection Severity Format
Detect RTLO In File Name Undefined SPL
Detect RTLO In Process Undefined SPL

elastic/detection-rules

1 rule
Detection Severity Format
File with Right-to-Left Override Character (RTLO) Created/Executed Medium Elastic TOML

elastic/protections-artifacts

1 rule
Detection Severity Format
Evasion via File Name Masquerading Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.