Suspicious Command Line Containing Right-to-Left Override

calendar Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002  ·
Share on: linkedin copy

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.

Sigma rule (View on GitHub)

 1title: Suspicious Command Line Containing Right-to-Left Override
 2id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
 3status: experimental
 4description: Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.
 5references:
 6    - https://redcanary.com/blog/right-to-left-override/
 7    - https://unicode-explorer.com/c/202E
 8author: Micah Babinski, @micahbabinski
 9date: 2023/01/30
10tags:
11    - attack.defense_evasion
12    - attack.t1036
13    - attack.t1036.002
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        # you can't see it, but trust me, there's a right-to-left override character in the regex below! :P
20        CommandLine|re: ^.*‮.*$
21    condition: selection
22falsepositives:
23    - Unknown
24level: high```

References

Related rules

to-top