Windows File Event: Flag Cyrillic Homoglyph Characters in Target Filename
Alerts on Windows file events with TargetFilename containing ASCII lookalike Unicode characters.
- Product
- windows
- Category
- file_event
- Author
- Micah Babinski, @micahbabinski (SigmaHQ), DRL 1.1
- Published
- 2023-05-08
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows file creation or access events where the TargetFilename contains specific Unicode characters that are visually similar to ASCII letters (homoglyphs). Such characters are commonly used to obfuscate filenames and make malicious items blend in by masquerading as familiar Latin text. It relies on Windows file_event telemetry that captures the TargetFilename field.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Event: Flag Cyrillic Homoglyph Characters in Target Filename"
id: 29e503c8-eb4a-440d-8f3d-64791f7bac9d
status: test
description: This rule identifies Windows file creation or access events where the TargetFilename contains specific Unicode characters that are visually similar to ASCII letters (homoglyphs). Such characters are commonly used to obfuscate filenames and make malicious items blend in by masquerading as familiar Latin text. It relies on Windows file_event telemetry that captures the TargetFilename field.
references:
- https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
- http://www.irongeek.com/homoglyph-attack-generator.php
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml
author: Micah Babinski, @micahbabinski, Huntrule Team
date: 2023-05-08
tags:
- attack.stealth
- attack.t1036
- attack.t1036.003
logsource:
category: file_event
product: windows
detection:
selection_upper:
TargetFilename|contains:
- А
- В
- Е
- К
- М
- Н
- О
- Р
- С
- Т
- Х
- Ѕ
- І
- Ј
- Ү
- Ӏ
- Ԍ
- Ԛ
- Ԝ
- Α
- Β
- Ε
- Ζ
- Η
- Ι
- Κ
- Μ
- Ν
- Ο
- Ρ
- Τ
- Υ
- Χ
selection_lower:
TargetFilename|contains:
- а
- е
- о
- р
- с
- х
- ѕ
- і
- ӏ
- ј
- һ
- ԁ
- ԛ
- ԝ
- ο
condition: 1 of selection_*
falsepositives:
- File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use.
level: medium
license: DRL-1.1
related:
- id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
type: derived