Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
11
5
2
2
1
Contributors
6
3
3
3
2
Categories
12
5
2
2
2
Platforms
19
2
1
Products / Services
9
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
1
1
Detects the Unicode RIGHT-TO-LEFT OVERRIDE character (U+202E) in process
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects RTLO Unicode character used to disguise malicious file extensions
This rule detects the presence of a Right-to-Left Override (RLO) character sequence in the content of an email sent over SMTP. The RLO character (U+202E, represented as E2 80 AE in UTF-8) is often used in phishing or malware campaigns to visually reverse the order of characters in a filename, making an executable file appear to be a benign file type (e.g., 'document.txt.exe' could appear as 'document.exe.txt'). The rule specifically looks for this byte sequence in traffic destined for port 25 (SMTP) and flags it as trojan activity.
This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.
Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
This rule detects the execution of executables with single-character filenames on Windows systems. Such filenames can be used by adversaries to obfuscate malicious activity, making it harder for users and security tools to identify the true nature of a file. This technique is often employed in malvertising campaigns or other forms of social engineering to trick users into executing seemingly benign files.
This rule detects the presence of percent-encoded Bi-Directional (BiDi) control characters in URLs within network events. Specifically, it looks for '%E2%80%AE' (Right-to-Left Override - RLO), '%E2%80%8E' (Left-to-Right Mark - LRM), and '%E2%80%8F' (Right-to-Left Mark - RLM). These characters can be used to obfuscate URLs, making malicious links appear benign to users and potentially bypass security controls.
This rule detects suspicious filenames that leverage the right-to-left override (RTLO) Unicode character (U+202E) in conjunction with a spoofed file extension. Adversaries use RTLO to visually reverse parts of a filename, making a malicious executable appear as a benign file type (e.g., 'evil.exe' appearing as 'evil.txt.exe' or 'document.pdf' appearing as 'document.exe'). The rule specifically looks for the RTLO character and a list of common file extensions that have been reversed (e.g., '3pm.' for '.mp3', 'cod.' for '.doc'). This technique is often used in phishing attacks to trick users into executing malicious files.
This rule detects the execution of `mmc.exe` with command-line arguments that indicate the use of Right-to-Left Override (RTLO) characters to disguise file extensions. Specifically, it looks for `.msc` files that, due to RTLO abuse, appear to be common document types like `.pdf`, `.doc`, `.xlsx`, etc., but are actually `.msc` files. This technique is often used by adversaries for defense evasion and to trick users into executing malicious files.
Detects the presence of the "u202+E" character in command lines, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This technique is used for obfuscation and masquerading to make malicious files appear benign.
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This is used as an obfuscation and masquerading techniques.
This is used as an obfuscation and masquerading techniques.
Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This is used as an obfuscation and masquerading techniques.
This is used as an obfuscation and masquerading techniques.
Query for SmartScreen application blocks on files with "Malicious" reputation, where the user has decided to run the malware nontheless.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
This query helps in reviewing top policies for user overrides (Allow/Block)
The following analytic identifies the use of the right-to-left override (RTLO) character in file names. It leverages data from the Endpoint.Filesystem datamodel, specifically focusing on file creation events and file names containing the RTLO character (U+202E). This activity is significant because adversaries use RTLO to disguise malicious files as benign by reversing the text that follows the character. If confirmed malicious, this technique can deceive users and security tools, leading to the execution of harmful files and potential system compromise.
Page 1 of 2