MMC Executing Files with Reversed Extensions Using RTLO Abuse
This rule detects the execution of `mmc.exe` with command-line arguments that indicate the use of Right-to-Left Override (RTLO) characters to disguise file extensions. Specifically, it looks for `.msc` files that, due to RTLO abuse, appear to be common document types like `.pdf`, `.doc`, `.xlsx`, etc., but are actually `.msc` files. This technique is often used by adversaries for defense evasion and to trick users into executing malicious files.
Sigma
