Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

title: Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line
id: ccfc42c7-08f7-46b7-9c5b-3bfe6b366a51
status: experimental
description: This rule flags Windows process creation events where mmc.exe is the image and the command line contains specific reversed-extension filename patterns ending in .msc. Using Right-to-Left Override can cause a file’s displayed extension to appear as a different document type, helping attackers disguise the true target. The detection relies on process creation telemetry including the process image path and the full command line text.
references:
  - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
  - https://en.wikipedia.org/wiki/Right-to-left_override
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_rlo_abuse_pattern.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.002
  - attack.t1218.014
  - attack.t1036.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    - Image|endswith: \mmc.exe
    - OriginalFileName: MMC.exe
  selection_commandline:
    CommandLine|contains:
      - cod.msc
      - fdp.msc
      - ftr.msc
      - lmth.msc
      - slx.msc
      - tdo.msc
      - xcod.msc
      - xslx.msc
      - xtpp.msc
  condition: all of selection_*
falsepositives:
  - Legitimate administrative actions using MMC to execute misnamed `.msc` files.
  - Unconventional but non-malicious usage of RLO or reversed extensions.
level: high
license: DRL-1.1
related:
  - id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44
    type: derived