RTLO Character Abuse Disguising .scr Executable as PDF
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Microsoft Sentinel (KQL)
