Query: detection rule: Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
Matching passage: Sigma rule: Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.. Logsource: windows / file_event. Rule: title: Potential File Extension Spoofing Using Right-to-Left Override id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4 related: - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: derived status: test description: 'Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions. ' references: - https://redcanary.com/blog/right-to-left-override/ - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-11-17 modified: 2026-03-20 tags: - attack.execution - attack.stealth - attack.t1036.002 logsource: category: file_event product: windows detection: selection_rtlo_unicode: TargetFilename|contains: - \u202e - '[U+202E]' - ‮ selection_extensions: TargetFilename|contains: - 3pm. - 4pm. - cod. - fdp. - ftr. - gepj. - gnp. - gpj. - ism. - lmth. - nls. - piz. - slx. - tdo. - vsc. - vwm. - xcod. - xslx. - xtpp. condition: all of selection_* falsepositives: - Filenames that contains scriptures such as arabic or hebrew might make use of this character level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml
Near-miss passage: Sigma rule: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines. Logsource: windows / process_creation. Rule: title: Suspicious Obfuscated PowerShell Code id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35 status: test description: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines references: - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/ author: Florian Roth (Nextron Systems) date: 2022-07-11 modified: 2023-02-14 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IAAtAGIAeABvAHIAIAAwAHgA - AALQBiAHgAbwByACAAMAB4A - gAC0AYgB4AG8AcgAgADAAeA - AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg - AuAEkAbgB2AG8AawBlACgAKQAgAHwAI - ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC - AHsAMQB9AHsAMAB9ACIAIAAtAGYAI - B7ADEAfQB7ADAAfQAiACAALQBmAC - AewAxAH0AewAwAH0AIgAgAC0AZgAg - AHsAMAB9AHsAMwB9ACIAIAAtAGYAI - B7ADAAfQB7ADMAfQAiACAALQBmAC - AewAwAH0AewAzAH0AIgAgAC0AZgAg - AHsAMgB9AHsAMAB9ACIAIAAtAGYAI - B7ADIAfQB7ADAAfQAiACAALQBmAC - AewAyAH0AewAwAH0AIgAgAC0AZgAg - AHsAMQB9AHsAMAB9ACcAIAAtAGYAI - B7ADEAfQB7ADAAfQAnACAALQBmAC - AewAxAH0AewAwAH0AJwAgAC0AZgAg - AHsAMAB9AHsAMwB9ACcAIAAtAGYAI - B7ADAAfQB7ADMAfQAnACAALQBmAC - AewAwAH0AewAzAH0AJwAgAC0AZgAg - AHsAMgB9AHsAMAB9ACcAIAAtAGYAI - B7ADIAfQB7ADAAfQAnACAALQBmAC - AewAyAH0AewAwAH0AJwAgAC0AZgAg condition: selection falsepositives: - Unknown level: high