Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-02-05
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1036.002Right-to-Left Override
- T1218.014MMC
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where mmc.exe is the image and the command line contains specific reversed-extension filename patterns ending in .msc. Using Right-to-Left Override can cause a file’s displayed extension to appear as a different document type, helping attackers disguise the true target. The detection relies on process creation telemetry including the process image path and the full command line text.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

Suspicious Interlock Fake Updater Executable Execution

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

SocGholish Fake Browser Update Script Execution (via process_creation)

Uncommon Executable Written to Startup Folder by WinRAR via CVE-2025-8088 Path Traversal (via file_event)

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Pivot detection · T1204.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mmc-executes-files-with-rlo-reversed-extensions-in-process-command-line-9cfe4b27

title: Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line
id: ccfc42c7-08f7-46b7-9c5b-3bfe6b366a51
status: experimental
description: This rule flags Windows process creation events where mmc.exe is the image and the command line contains specific reversed-extension filename patterns ending in .msc. Using Right-to-Left Override can cause a file’s displayed extension to appear as a different document type, helping attackers disguise the true target. The detection relies on process creation telemetry including the process image path and the full command line text.
references:
  - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
  - https://en.wikipedia.org/wiki/Right-to-left_override
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_rlo_abuse_pattern.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.002
  - attack.t1218.014
  - attack.t1036.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    - Image|endswith: \mmc.exe
    - OriginalFileName: MMC.exe
  selection_commandline:
    CommandLine|contains:
      - cod.msc
      - fdp.msc
      - ftr.msc
      - lmth.msc
      - slx.msc
      - tdo.msc
      - xcod.msc
      - xslx.msc
      - xtpp.msc
  condition: all of selection_*
falsepositives:
  - Legitimate administrative actions using MMC to execute misnamed `.msc` files.
  - Unconventional but non-malicious usage of RLO or reversed extensions.
level: high
license: DRL-1.1
related:
  - id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL