Windows File Event: Detect Unicode Right-to-Left Override Extension Spoofing

Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.

FreeUnreviewedSigmahighv1

windows-file-event-detect-unicode-right-to-left-override-extension-spoofing-979baf41

title: "Windows File Event: Detect Unicode Right-to-Left Override Extension Spoofing"
id: eec9f06b-939f-4530-a29f-f37c8785e4e1
related:
  - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
    type: derived
  - id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4
    type: derived
status: test
description: This rule identifies Windows file events where TargetFilename contains the Unicode right-to-left override (U+202E) character and also includes a set of reversed file-extension patterns (e.g., 3pm., 4pm., cod.). Such names can mislead users and tools by visually disguising the apparent extension, supporting stealthy execution or social engineering. It relies on file-event telemetry that captures the TargetFilename field.
references:
  - https://redcanary.com/blog/right-to-left-override/
  - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml
author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2024-11-17
modified: 2026-03-20
tags:
  - attack.execution
  - attack.stealth
  - attack.t1036.002
logsource:
  category: file_event
  product: windows
detection:
  selection_rtlo_unicode:
    TargetFilename|contains:
      - \u202e
      - "[U+202E]"
      - ‮
  selection_extensions:
    TargetFilename|contains:
      - 3pm.
      - 4pm.
      - cod.
      - fdp.
      - ftr.
      - gepj.
      - gnp.
      - gpj.
      - ism.
      - lmth.
      - nls.
      - piz.
      - slx.
      - tdo.
      - vsc.
      - vwm.
      - xcod.
      - xslx.
      - xtpp.
  condition: all of selection_*
falsepositives:
  - Filenames that contains scriptures such as arabic or hebrew might make use of this character
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml
license: DRL-1.1

What it detects

This rule identifies Windows file events where TargetFilename contains the Unicode right-to-left override (U+202E) character and also includes a set of reversed file-extension patterns (e.g., 3pm., 4pm., cod.). Such names can mislead users and tools by visually disguising the apparent extension, supporting stealthy execution or social engineering. It relies on file-event telemetry that captures the TargetFilename field.

Known false positives

Filenames that contains scriptures such as arabic or hebrew might make use of this character

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.