Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)

Alerts on Windows process launches with command lines containing Unicode U+202E to support right-to-left text obfuscation.

FreeUnreviewedSigmahighv1

windows-process-command-line-containing-unicode-right-to-left-override-u-202e-ad691d92

title: Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)
id: 98e4ff86-0134-46e9-acbf-6256d6bf8100
related:
  - id: e0552b19-5a83-4222-b141-b36184bb8d79
    type: derived
  - id: 584bca0f-3608-4402-80fd-4075ff6072e3
    type: derived
  - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
    type: derived
status: test
description: This rule flags Windows process creation events whose command line contains the Unicode Right-to-Left Override character (U+202E) or its textual representation. Attackers may use this character to obfuscate filenames or content and mislead users by changing the displayed text order. The detection relies on process creation telemetry with access to the full command line string.
references:
  - https://redcanary.com/blog/right-to-left-override/
  - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
  - https://unicode-explorer.com/c/202E
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml
author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux, Huntrule Team
date: 2023-02-15
modified: 2026-03-20
tags:
  - attack.stealth
  - attack.t1036.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - \u202e
      - "[U+202E]"
      - ‮
  condition: selection
falsepositives:
  - Commandlines that contains scriptures such as arabic or hebrew might make use of this character
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command line contains the Unicode Right-to-Left Override character (U+202E) or its textual representation. Attackers may use this character to obfuscate filenames or content and mislead users by changing the displayed text order. The detection relies on process creation telemetry with access to the full command line string.

Known false positives

Commandlines that contains scriptures such as arabic or hebrew might make use of this character

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.