Potential Homoglyph Attack Using Lookalike Characters

 1title: Potential Homoglyph Attack Using Lookalike Characters
 2id: 32e280f1-8ad4-46ef-9e80-910657611fbc
 3status: experimental
 4description: |
 5    Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
 6    This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
 7    are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.    
 8references:
 9    - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
10    - http://www.irongeek.com/homoglyph-attack-generator.php
11author: Micah Babinski, @micahbabinski
12date: 2023/05/07
13tags:
14    - attack.defense_evasion
15    - attack.t1036
16    - attack.t1036.003
17    - attack.t1036.008
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        CommandLine|contains:
24            - "\u0410" # А/A
25            - "\u0430" # а/a
26            - "\u0412" # В/B
27            - "\u0415" # Е/E
28            - "\u0435" # е/e
29            - "\u041a" # К/K
30            - "\u041c" # М/M
31            - "\u041d" # Н/H
32            - "\u041e" # О/O
33            - "\u043e" # о/o
34            - "\u0420" # Р/P
35            - "\u0440" # р/p
36            - "\u0421" # С/C
37            - "\u0441" # с/c
38            - "\u0422" # Т/T
39            - "\u0425" # Х/X
40            - "\u0445" # х/x
41            - "\u0405" # Ѕ/S
42            - "\u0455" # ѕ/s
43            - "\u0406" # І/I
44            - "\u0456" # і/i
45            - "\u0408" # Ј/J
46            - "\u0458" # ј/j
47            - "\u04ae" # Ү/Y
48            - "\u04bb" # һ/h
49            - "\u04c0" # Ӏ/I
50            - "\u04cf" # ӏ/l
51            - "\u0501" # ԁ/d
52            - "\u050C" # Ԍ/G
53            - "\u051a" # Ԛ/Q
54            - "\u051b" # ԛ/q
55            - "\u051c" # Ԝ/W
56            - "\u051d" # ԝ/w
57            - "\u0391" # Α/A
58            - "\u0392" # Β/B
59            - "\u0395" # Ε/E
60            - "\u0396" # Ζ/Z
61            - "\u0397" # Η/H
62            - "\u0399" # Ι/I
63            - "\u039a" # Κ/K
64            - "\u039c" # Μ/M
65            - "\u039d" # Ν/N
66            - "\u039f" # Ο/O
67            - "\u03bf" # ο/o
68            - "\u03a1" # Ρ/P
69            - "\u03a4" # Τ/T
70            - "\u03a5" # Υ/Y
71            - "\u03a7" # Χ/X
72    condition: selection
73falsepositives:
74    - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.
75level: medium```