Potential Homoglyph Attack Using Lookalike Characters in Filename

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•23

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.