Possible Homoglyph Attack Via Lookalike Characters in Filename (via file_event)

title: Possible Homoglyph Attack Via Lookalike Characters in Filename (via file_event)
id: 01c63d31-59d1-56b8-b369-acb2662eef7e
status: stable
description: This rule detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
references:
    - https://attack.mitre.org/techniques/T1036/003/
    - https://attack.mitre.org/techniques/T1036/
    - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
    - http://www.irongeek.com/homoglyph-attack-generator.php
author: Huntrule Team
date: 2026-02-13
tags:
    - attack.stealth
    - attack.t1036
    - attack.t1036.003
logsource:
    category: file_event
    product: windows
detection:
    selection_upper:
        TargetFilename|contains:
            - "А"
            - "В"
            - "Е"
            - "К"
            - "М"
            - "Н"
            - "О"
            - "Р"
            - "С"
            - "Т"
            - "Х"
            - "Ѕ"
            - "І"
            - "Ј"
            - "Ү"
            - "Ӏ"
            - "Ԍ"
            - "Ԛ"
            - "Ԝ"
            - "Α"
            - "Β"
            - "Ε"
            - "Ζ"
            - "Η"
            - "Ι"
            - "Κ"
            - "Μ"
            - "Ν"
            - "Ο"
            - "Ρ"
            - "Τ"
            - "Υ"
            - "Χ"
    selection_lower:
        TargetFilename|contains:
            - "а"
            - "е"
            - "о"
            - "р"
            - "с"
            - "х"
            - "ѕ"
            - "і"
            - "ӏ"
            - "ј"
            - "һ"
            - "ԁ"
            - "ԛ"
            - "ԝ"
            - "ο"
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium