Windows File Events: Flag Unicode Homoglyphs in TargetFilename

title: "Windows File Events: Flag Unicode Homoglyphs in TargetFilename"
id: 29e503c8-eb4a-440d-8f3d-64791f7bac9d
status: test
description: This rule flags Windows file activity where the TargetFilename contains specific Unicode homoglyph characters that can visually resemble ASCII letters (e.g., Cyrillic/Greek/other lookalikes). Attackers may use these characters to obfuscate malicious filenames or masquerade as legitimate files, relying on visual confusion rather than functional differences. It relies on Windows file event telemetry that records TargetFilename strings and matches for the listed “perfect” lookalike characters.
references:
  - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
  - http://www.irongeek.com/homoglyph-attack-generator.php
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml
author: Micah Babinski, @micahbabinski, Huntrule Team
date: 2023-05-08
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1036.003
logsource:
  category: file_event
  product: windows
detection:
  selection_upper:
    TargetFilename|contains:
      - А
      - В
      - Е
      - К
      - М
      - Н
      - О
      - Р
      - С
      - Т
      - Х
      - Ѕ
      - І
      - Ј
      - Ү
      - Ӏ
      - Ԍ
      - Ԛ
      - Ԝ
      - Α
      - Β
      - Ε
      - Ζ
      - Η
      - Ι
      - Κ
      - Μ
      - Ν
      - Ο
      - Ρ
      - Τ
      - Υ
      - Χ
  selection_lower:
    TargetFilename|contains:
      - а
      - е
      - о
      - р
      - с
      - х
      - ѕ
      - і
      - ӏ
      - ј
      - һ
      - ԁ
      - ԛ
      - ԝ
      - ο
  condition: 1 of selection_*
falsepositives:
  - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use.
level: medium
license: DRL-1.1
related:
  - id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
    type: derived