Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)
Alerts on Windows process launches with command lines containing Unicode U+202E to support right-to-left text obfuscation.
- Product
- windows
- Category
- process_creation
- Author
- Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux (SigmaHQ), DRL 1.1
- Published
- 2023-02-15
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command line contains the Unicode Right-to-Left Override character (U+202E) or its textual representation. Attackers may use this character to obfuscate filenames or content and mislead users by changing the displayed text order. The detection relies on process creation telemetry with access to the full command line string.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/right-to-left-override/
- malwarebytes.comhttps://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
- unicode-explorer.comhttps://unicode-explorer.com/c/202E
- tria.gehttps://tria.ge/241015-l98snsyeje/behavioral2
- unprotect.ithttps://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Command-Line Containing Unicode Right-to-Left Override (U+202E)
id: 98e4ff86-0134-46e9-acbf-6256d6bf8100
related:
- id: e0552b19-5a83-4222-b141-b36184bb8d79
type: derived
- id: 584bca0f-3608-4402-80fd-4075ff6072e3
type: derived
- id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
type: derived
status: test
description: This rule flags Windows process creation events whose command line contains the Unicode Right-to-Left Override character (U+202E) or its textual representation. Attackers may use this character to obfuscate filenames or content and mislead users by changing the displayed text order. The detection relies on process creation telemetry with access to the full command line string.
references:
- https://redcanary.com/blog/right-to-left-override/
- https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
- https://unicode-explorer.com/c/202E
- https://tria.ge/241015-l98snsyeje/behavioral2
- https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml
author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux, Huntrule Team
date: 2023-02-15
modified: 2026-03-20
tags:
- attack.stealth
- attack.t1036.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- \u202e
- "[U+202E]"
-
condition: selection
falsepositives:
- Commandlines that contains scriptures such as arabic or hebrew might make use of this character
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override/info.yml
license: DRL-1.1