Potential Homoglyph Attack Using Lookalike Characters

 1title: Potential Homoglyph Attack Using Lookalike Characters
 2id: 32e280f1-8ad4-46ef-9e80-910657611fbc
 3status: test
 4description: |
 5    Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
 6    This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
 7    are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.    
 8references:
 9    - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
10    - http://www.irongeek.com/homoglyph-attack-generator.php
11author: Micah Babinski, @micahbabinski
12date: 2023-05-07
13tags:
14    - attack.stealth
15    - attack.t1036
16    - attack.t1036.003
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_upper:
22        CommandLine|contains:
23            - "\u0410" # А/A
24            - "\u0412" # В/B
25            - "\u0415" # Е/E
26            - "\u041a" # К/K
27            - "\u041c" # М/M
28            - "\u041d" # Н/H
29            - "\u041e" # О/O
30            - "\u0420" # Р/P
31            - "\u0421" # С/C
32            - "\u0422" # Т/T
33            - "\u0425" # Х/X
34            - "\u0405" # Ѕ/S
35            - "\u0406" # І/I
36            - "\u0408" # Ј/J
37            - "\u04ae" # Ү/Y
38            - "\u04c0" # Ӏ/I
39            - "\u050C" # Ԍ/G
40            - "\u051a" # Ԛ/Q
41            - "\u051c" # Ԝ/W
42            - "\u0391" # Α/A
43            - "\u0392" # Β/B
44            - "\u0395" # Ε/E
45            - "\u0396" # Ζ/Z
46            - "\u0397" # Η/H
47            - "\u0399" # Ι/I
48            - "\u039a" # Κ/K
49            - "\u039c" # Μ/M
50            - "\u039d" # Ν/N
51            - "\u039f" # Ο/O
52            - "\u03a1" # Ρ/P
53            - "\u03a4" # Τ/T
54            - "\u03a5" # Υ/Y
55            - "\u03a7" # Χ/X
56    selection_lower:
57        CommandLine|contains:
58            - "\u0430" # а/a
59            - "\u0435" # е/e
60            - "\u043e" # о/o
61            - "\u0440" # р/p
62            - "\u0441" # с/c
63            - "\u0445" # х/x
64            - "\u0455" # ѕ/s
65            - "\u0456" # і/i
66            - "\u04cf" # ӏ/l
67            - "\u0458" # ј/j
68            - "\u04bb" # һ/h
69            - "\u0501" # ԁ/d
70            - "\u051b" # ԛ/q
71            - "\u051d" # ԝ/w
72            - "\u03bf" # ο/o
73    condition: 1 of selection_*
74falsepositives:
75    - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use.
76level: medium