Query: detect Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions. in logs
Matching passage: Sigma rule: Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.. Logsource: windows / file_event. Rule: title: Potential File Extension Spoofing Using Right-to-Left Override id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4 related: - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: derived status: test description: 'Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions. ' references: - https://redcanary.com/blog/right-to-left-override/ - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-11-17 modified: 2026-03-20 tags: - attack.execution - attack.stealth - attack.t1036.002 logsource: category: file_event product: windows detection: selection_rtlo_unicode: TargetFilename|contains: - \u202e - '[U+202E]' - ‮ selection_extensions: TargetFilename|contains: - 3pm. - 4pm. - cod. - fdp. - ftr. - gepj. - gnp. - gpj. - ism. - lmth. - nls. - piz. - slx. - tdo. - vsc. - vwm. - xcod. - xslx. - xtpp. condition: all of selection_* falsepositives: - Filenames that contains scriptures such as arabic or hebrew might make use of this character level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml
Near-miss passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c related: - id: b37998de-a70b-4f33-b219-ec36bf433dc0 type: derived status: test description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level. references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: - MD5=f741f25ac909ee434e50812d436c73ff - MD5=d40acbfc29ee24388262e3d8be16f622 - MD5=01bb2c16fadb992fa66228cd02d45c60 - MD5=9e1b18e62e42b5444fc55b51e640355b - MD5=b7f8fe33ac471b074ca9e630ba0c7e79 - MD5=324579d717c9b9b8e71d0269d13f811f - MD5=63257a1ddaf83cfa43fe24a3bc06c207 - MD5=049e85963826b059c9bac273bb9c82ab - MD5=ecb98b7b4d4427eb8221381154ff4cb2 - MD5=faf87749ac790ec3a10dd069d10f9d63 - MD5=f296dba5d21ad18e6990b1992aea8f83 - MD5=93ba94355e794b6c6f98204cf39f7a11 - MD5=a258ef593ac63155523a461ecc73bdba - MD5=97000eb5d1653f1140ee3f47186463c4 - MD5=95eb317fbbe14a82bd9fdf31c48b8d93 - MD5=32fe9f0d2630ac40ea29023920f20f49 - MD5=a05930dde939cfd02677fc18bb2b7df5 - MD5=124283924e86933ff9054a549d3a268b - MD5=ceda6909b8573fdeb0351c6920225686 - MD5=60ce120040f2cd311c810ae6f6bbc182 - MD5=2f10cdc5b09100a260703a28eadd0ceb - MD5=011d967028e797a4c16d547f7ba1463f - MD5=2da9152c0970500c697c1c9b4a9e0360 - MD5=b5ba72034b8f44d431f55275bace9f8b - MD5=d6ed9101df0f24e27ff92ddab42dacca - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d - MD5=5e083cd0143ae95a6cb79b68c07ca573 - MD5=28caff93748cb84be70486e79f04c2df - MD5=9d4f12c30f9b500f896efd1800e4dd11 - MD5=4586f7dd14271ad65a5fb696b393f4c0 - MD5=86ba9dddbdf49215145b5bcd081d4011 - MD5=9dce0a481343874ef9a36