Right-to-Left Override Character in Process Command Line

Tim Peck@timpeck

•updated Jul 19, 2026•9•2•50

Detects the Unicode RIGHT-TO-LEFT OVERRIDE character (U+202E) in process command lines. Adversaries insert RTLO to reverse the rendering of a filename so an executable payload displays as a benign document type.