Potential File Extension Spoofing Using Right-to-Left Override

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2025•0•20

This rule detects suspicious filenames that leverage the right-to-left override (RTLO) Unicode character (U+202E) in conjunction with a spoofed file extension. Adversaries use RTLO to visually reverse parts of a filename, making a malicious executable appear as a benign file type (e.g., 'evil.exe' appearing as 'evil.txt.exe' or 'document.pdf' appearing as 'document.exe'). The rule specifically looks for the RTLO character and a list of common file extensions that have been reversed (e.g., '3pm.' for '.mp3', 'cod.' for '.doc'). This technique is often used in phishing attacks to trick users into executing malicious files.