Windows File Event: Detect RTLO Filename Extension Spoofing
Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.
- Product
- windows
- Category
- file_event
- Author
- Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-11-17
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file events where the target filename contains the Unicode right-to-left override (RTLO) character and also includes one of several reversed (spoofed) file extension patterns. Such filenames can visually mislead users about the true file type, supporting stealthy execution and delivery attempts. It relies on file event telemetry that provides the TargetFilename value, allowing pattern matching for the RTLO character and the predefined extension strings.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/right-to-left-override/
- malwarebytes.comhttps://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
- tria.gehttps://tria.ge/241015-l98snsyeje/behavioral2
- unicode.orghttps://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Event: Detect RTLO Filename Extension Spoofing"
id: eec9f06b-939f-4530-a29f-f37c8785e4e1
related:
- id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
type: derived
- id: 979baf41-ca44-4540-9d0c-4fcef3b5a3a4
type: derived
status: test
description: This rule flags Windows file events where the target filename contains the Unicode right-to-left override (RTLO) character and also includes one of several reversed (spoofed) file extension patterns. Such filenames can visually mislead users about the true file type, supporting stealthy execution and delivery attempts. It relies on file event telemetry that provides the TargetFilename value, allowing pattern matching for the RTLO character and the predefined extension strings.
references:
- https://redcanary.com/blog/right-to-left-override/
- https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
- https://tria.ge/241015-l98snsyeje/behavioral2
- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml
author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2024-11-17
modified: 2026-03-20
tags:
- attack.execution
- attack.stealth
- attack.t1036.002
logsource:
category: file_event
product: windows
detection:
selection_rtlo_unicode:
TargetFilename|contains:
- \u202e
- "[U+202E]"
-
selection_extensions:
TargetFilename|contains:
- 3pm.
- 4pm.
- cod.
- fdp.
- ftr.
- gepj.
- gnp.
- gpj.
- ism.
- lmth.
- nls.
- piz.
- slx.
- tdo.
- vsc.
- vwm.
- xcod.
- xslx.
- xtpp.
condition: all of selection_*
falsepositives:
- Filenames that contains scriptures such as arabic or hebrew might make use of this character
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing/info.yml
license: DRL-1.1