attack.t1036.002

MMC Executing Files with Reversed Extensions Using RTLO Abuse

Oct 1, 2025 · attack.execution attack.t1204.002 attack.defense-evasion attack.t1218.014 attack.t1036.002 ·

Detects malicious behavior where the MMC utility (mmc.exe) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Potential Defense Evasion Via Right-to-Left Override

Oct 1, 2025 · attack.defense-evasion attack.t1036.002 ·

Share on:

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used as an obfuscation and masquerading techniques.

Potential File Extension Spoofing Using Right-to-Left Override

Oct 1, 2025 · attack.execution attack.defense-evasion attack.t1036.002 ·

Share on:

Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.

Suspicious Command Line Containing Right-to-Left Override

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.002 ·

Share on:

Detects the presence of the u202+E character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This is used in obfuscation and masquerading techniques.