Right-to-Left Override Character in Filename

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.