Windows File Event: Flag Cyrillic Homoglyph Characters in Target Filename

title: "Windows File Event: Flag Cyrillic Homoglyph Characters in Target Filename"
id: 29e503c8-eb4a-440d-8f3d-64791f7bac9d
status: test
description: This rule identifies Windows file creation or access events where the TargetFilename contains specific Unicode characters that are visually similar to ASCII letters (homoglyphs). Such characters are commonly used to obfuscate filenames and make malicious items blend in by masquerading as familiar Latin text. It relies on Windows file_event telemetry that captures the TargetFilename field.
references:
  - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
  - http://www.irongeek.com/homoglyph-attack-generator.php
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml
author: Micah Babinski, @micahbabinski, Huntrule Team
date: 2023-05-08
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1036.003
logsource:
  category: file_event
  product: windows
detection:
  selection_upper:
    TargetFilename|contains:
      - А
      - В
      - Е
      - К
      - М
      - Н
      - О
      - Р
      - С
      - Т
      - Х
      - Ѕ
      - І
      - Ј
      - Ү
      - Ӏ
      - Ԍ
      - Ԛ
      - Ԝ
      - Α
      - Β
      - Ε
      - Ζ
      - Η
      - Ι
      - Κ
      - Μ
      - Ν
      - Ο
      - Ρ
      - Τ
      - Υ
      - Χ
  selection_lower:
    TargetFilename|contains:
      - а
      - е
      - о
      - р
      - с
      - х
      - ѕ
      - і
      - ӏ
      - ј
      - һ
      - ԁ
      - ԛ
      - ԝ
      - ο
  condition: 1 of selection_*
falsepositives:
  - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use.
level: medium
license: DRL-1.1
related:
  - id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6
    type: derived