Potential Defense Evasion Via Right-to-Left Override

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.