Process image or command line contains a right-to-left override character

Siemphony@siemphonyhighT1036.002unverified

AN1461 asks for execution of files whose name carries the RTLO character (U+202E) to reverse the display of the true extension. That character is rare enough in ordinary filenames that its literal presence in a Sysmon process-creation record is a strong single-event signal by itself, so the rule tests for it directly rather than trying to reconstruct which substring got display-reversed. Two arms cover the two ways the character reaches this event: `Image` catches the case where the RTLO-named file is itself the thing that gets executed (a disguised .scr launched directly), and `CommandLine` catches the case where a shell or interpreter is the process actually created and the RTLO-named file is only an argument (a double-clicked .js opened by wscript.exe, or an attachment path handed to a mail client's viewer). MITRE's ExecutionContext knob — scoping to browser downloads or mail attachments — is not applied here because Sysmon process creation carries no reference to the file's origin; adding that context needs a Zone.Identifier alternate-data-stream check this log source cannot provide, so this rule is origin-agnostic and will fire on an RTLO-named file regardless of where it came from. The Linux (AN1463) and macOS (AN1462) legs of this strategy are not attempted: their log sources are auditd execve and osquery/endpointsecurity/unifiedlog, none of which this pipeline has a verified field vocabulary for, so a rule against them would be guessing field names rather than authoring against known ones. Sysmon is not present on a default Windows install and needs a ProcessCreate rule in its configuration; without it this rule returns nothing, which reads as quiet rather than as blind telemetry. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0527, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath contains "‮" or ProcessCommandLine contains "‮")

Splunk · SPL

Run this as a search.

index=* (Image="*‮*" OR CommandLine="*‮*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*‮*" OR TO_LOWER(process.command_line) LIKE "*‮*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)‮</field>    <description>Process image or command line contains a right-to-left override character (1/2)</description>    <mitre>      <id>T1036.002</id>    </mitre>  </rule>   <rule id="100001" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)‮</field>    <description>Process image or command line contains a right-to-left override character (2/2)</description>    <mitre>      <id>T1036.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a59ae492-be61-430a-9e83-34fd6f49df45

ATT&CKT1036.002

T1036.002Right-to-Left Override

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

MITRE's AN1461 describes a masquerading trick: an attacker names a file so that the Unicode right-to-left override character (RTLO, U+202E) sits inside it, flipping the display order of the characters that follow so a dangerous extension like .exe reads as something benign, e.g. invoice‮fdp.exe displaying as invoiceexe.pdf. This rule looks for the RTLO character itself, on the theory that its mere presence in a Windows process-creation record is unusual enough to be a strong signal on its own — it does not try to reverse-engineer which substring got flipped.

02 · Telemetry you need

Sysmon Event ID 1 (ProcessCreate), which is not enabled on a default Windows install and needs a ProcessCreate rule in the Sysmon configuration. Without it the rule returns nothing, which looks quiet but actually means blind — there is no telemetry to evaluate at all.

03 · How the logic works

Two selections, OR'd together (condition: 1 of selection_*): selection_image tests whether Image contains the literal RTLO character, covering the case where the RTLO-named file is itself the executed process (a disguised .scr launched directly). selection_cmdline tests the same character against CommandLine, covering the case where a shell or interpreter is the process actually created and the RTLO-named file is only an argument — a double-clicked .js opened by wscript.exe, or an attachment path handed to a viewer. Either arm firing is enough. MITRE's ExecutionContext knob asks for scoping this to browser downloads or mail attachments specifically. This rule does not apply that knob: Sysmon process creation carries no reference to a file's origin, and adding that context would need a Zone.Identifier alternate-data-stream check this log source cannot provide. So the rule is origin-agnostic — it fires on any RTLO-named file regardless of where it came from, which is broader than MITRE's strategy but the only option this telemetry supports. The brief's Linux (AN1463, auditd execve) and macOS (AN1462, osquery/endpointsecurity/unifiedlog) legs of this strategy were not attempted. This pipeline has no verified field vocabulary for those log sources, and guessing field names would produce a rule that parses but never matches — the exact silent failure this corpus exists to avoid.

04 · Common false positives

Two false-positive sources, both narrow. First, security-awareness training kits and RTLO-detection test suites deliberately create and run a sample file such as invoice‮fdp.exe to demonstrate the technique or verify tooling — these are reused across many blog posts and tabletop exercises, so an environment running one will trip this rule exactly as designed. Second, a legitimately right-to-left-script filename (Arabic, Hebrew, Persian, Urdu) authored with an explicit RTLO/PDF override pair for correct display in older, non-bidi-aware software, then opened through its normal handler.

05 · Detection maturity

tier_1: This rule sits at the lowest DeBMM tier: authored from MITRE's analytic prose, never executed against a real log line, and unverified. It should be treated as a scaffold to validate against actual Sysmon output — including confirming the RTLO character survives your SIEM's ingestion pipeline without normalization — before any confidence is placed in it.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Both false positives listed above are genuinely narrow — RTLO is rare in ordinary filenames — which is why level: high is defensible as written. One coverage gap that does not affect firing: MITRE's FilenamePattern knob also covers RTLO delivered as URL-encoded (%E2%80%AE) or otherwise byte-encoded text, but Sysmon logs the resolved filename rather than the attacker's encoded input, so this rule already catches that case implicitly. If you deploy this, expect to allowlist known training-file names quickly after the first alert, and confirm your environment's users are not legitimately shipping RTL-script filenames before keeping the level at high.

Declared by the author

Security-awareness training kits and RTLO-detection test suites that deliberately create and run a sample file such as 'invoice‮fdp.exe' to demonstrate the technique or to verify that detection tooling catches it; these are published and reused across many blog posts and tabletop exercises.
A right-to-left-script filename (Arabic, Hebrew, Persian, Urdu) that was authored with an explicit RTLO/PDF override pair for correct display in older, non-bidi-aware software, rather than relying on the OS's automatic bidirectional algorithm, and is then opened or run through its normal handler.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/a59ae492-be61-430a-9e83-34fd6f49df45

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process image or command line contains a right-to-left override character

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it