Right-to-Left Override in Email Attachment Name
This rule detects the presence of a Right-to-Left Override (RLO) character sequence in the content of an email sent over SMTP. The RLO character (U+202E, represented as E2 80 AE in UTF-8) is often used in phishing or malware campaigns to visually reverse the order of characters in a filename, making an executable file appear to be a benign file type (e.g., 'document.txt.exe' could appear as 'document.exe.txt'). The rule specifically looks for this byte sequence in traffic destined for port 25 (SMTP) and flags it as trojan activity.
Suricata
