attack.t1036.002

Potential File Extension Spoofing Using Right-to-Left Override

Nov 18, 2024 · attack.execution attack.defense-evasion attack.t1036.002 ·

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Potential Defense Evasion Via Right-to-Left Override

Sep 6, 2024 · attack.defense-evasion attack.t1036.002 ·

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Suspicious Command Line Containing Right-to-Left Override

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002 ·

Share on:

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.