Executable path uses RLO or trailing-space filename trick

Siemphony@siemphonymediumT1036unverified

AN0356's Linux leg names two masquerading mechanisms — dropping a renamed binary in an uncommon directory such as /tmp or /dev/shm, and "special characters in names (e.g., trailing space, Unicode RLO)" — joined to a cronjob or execution that follows shortly after. This rule takes only the second mechanism. The Unicode right-to-left override (U+202E) and a space inserted immediately before the final extension are both classic filename masquerades: RLO reverses the characters that follow it so a name built as `cod.exe<RLO>gnp.` displays as `.png.exe`-reversed-to-`.exe.png`, and a trailing space is the same trick worked by whitespace rather than a control character. Both are properties of the executed `Image` path itself, so a single auditd execve record carries the whole observable — no join or window is needed for this half of the analytic, unlike the directory-drop half. That half is deliberately not attempted: execution from /tmp or /dev/shm alone, with `ExecutionDelayWindow` removed because lib/sigma has no timeframe construct, is indistinguishable from the very large volume of legitimate temp-directory execution already producing false positives elsewhere in this corpus, and MITRE's own framing treats the short delay after file drop as what makes it suspicious, not the directory alone. This is `FilenameAnomalies`, MITRE's knob for "regex for Unicode/RLO/space abuse in filenames", populated here with those two specific constructions rather than a general anomaly score no field in this brief can compute. AN0355 (Windows) is not attempted: its single-event half — `OriginalFilenameMismatch` on a renamed LOLBIN — is the exact observable T1036.003 already publishes against Sysmon EventID 1, and re-authoring it here under a different technique ID would double-count the same signal rather than add coverage; its other half needs 7045 correlated to a prior file write within a `TimeWindow`, which is unsupported, and 7045 alone carries no PE-metadata field to test a mismatch against. AN0357 (macOS) is not attempted either: all three of its log sources — unifiedlog, EndpointSecurity, osquery — have no standardised Sigma field vocabulary, the same blocker recorded against these sources for T1027.005 and T1027.008; inventing field names for `InfoPlistDiscrepancy` would produce a rule that parses and renders in four backends while matching nothing. Prerequisite: auditd records no execve at all until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, which no mainstream distribution ships by default — until then this rule returns zero rows, and zero rows here means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0127, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath contains "‮" or FolderPath matches regex "(?i) \\.[A-Za-z0-9]{1,6}$")

Splunk · SPL

Run this as a search.

index=* | where (match(Image, "(?i)‮") OR match(Image, " \\.[A-Za-z0-9]{1,6}$"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(‮| \.[A-Za-z0-9]{1,6}$)</field>    <description>Executable path uses RLO or trailing-space filename trick</description>    <mitre>      <id>T1036</id>    </mitre>  </rule></group>

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_creation / linux
Level: medium
Category: masquerading
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: cfa60147-efdc-4721-90fc-e84d29d88fc9

ATT&CKT1036

T1036Masquerading

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

The filename-trickery half of AN0356's Linux leg: a Unicode right-to-left override character (U+202E) or a trailing space inserted immediately before a file's extension, both used to make an executed binary's name display as something other than what it is — cod.exe<RLO>gnp. renders as .png.exe reversed to look like .exe.png, and a trailing space works the same trick with whitespace instead of a control character. The rule does not attempt AN0356's other half, execution from an uncommon directory (/tmp, /dev/shm) shortly after a file drop.

02 · Telemetry you need

A single Linux process_creation event — in practice, auditd execve records with the Image field populated. auditd records no execve at all until a rule such as -a always,exit -F arch=b64 -S execve -k exec is loaded, which no mainstream distribution ships by default. Until that rule is loaded, this detection returns zero rows, and zero rows here means blind, not quiet — the prerequisite is stated in the rule's own description for that reason.

03 · How the logic works

Two selections, condition: selection_rlo or selection_trailing_space. selection_rlo matches Image containing the literal U+202E character. selection_trailing_space is a regex, a space followed by a one-to-six character extension at the end of the path. Both test only the Image field of the process actually executed — a single event carries the whole observable, no join or timeframe needed, unlike the directory-drop half of the analytic. This is MITRE's FilenameAnomalies knob, described as "regex for Unicode/RLO/space abuse in filenames," populated here with exactly these two constructions rather than a general anomaly score no field in this brief can compute. The directory-drop half was deliberately left out: alone, without ExecutionDelayWindow (unsupported — lib/sigma has no timeframe construct), execution from /tmp is indistinguishable from the very large volume of legitimate temp-directory activity, and MITRE's own framing treats the delay after drop as what makes it suspicious, not the directory alone.

04 · Common false positives

Three sources, level: medium: RLO characters embedded correctly by browsers or mail clients for right-to-left locale filenames (Arabic, Hebrew, Persian mixed with a Latin extension), where a later script executing that path carries the same character with no masquerade intended; Unicode-conformance and internationalisation test suites for file managers, indexers and backup tools that intentionally generate RLO or trailing-space fixture names and then execute the harness against them; and archives authored on Windows or macOS whose zip entries carry a trailing space, extracted and run on Linux by a build or install script, reproducing the pattern as inherited metadata rather than intent.

05 · Detection maturity

tier_1: This rule has never fired against a real log line and sits at the lowest DeBMM maturity tier by construction. It is a scaffold built from two named string shapes, not a validated detection, and its falsepositive list is an untested estimate. It requires the auditd execve rule to be loaded before it can produce any output, a run against real telemetry, and human review before it earns a higher tier.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The two regex/literal checks are narrow by design and unlikely to need loosening; tuning here is mostly about the false-positive list. Locale-aware environments should suppress selection_rlo for known mixed-script file trees or mail/download directories. CI runners executing internationalization test suites are good candidates for a path-based allowlist. Because the directory-drop half of AN0356 is entirely unattempted, this rule alone will miss masquerading that relies on location rather than the filename itself; pairing it with a separate /tmp-or-/dev/shm execution rule, correlated manually to a recent file write, would close that gap MITRE describes but lib/sigma cannot express natively.

Declared by the author

Right-to-left locale content handled correctly. A browser or mail client saving an attachment whose original name mixes Arabic, Hebrew or Persian script with a Latin extension can legitimately embed a U+202E formatting mark so the mixed-script name renders in the intended order, and a script that later opens or processes that file executes a path containing the same character with no masquerade intended.
Unicode conformance and internationalisation test suites. QA harnesses for file managers, indexers and backup tools intentionally generate fixture files with RLO or trailing-space names to verify correct handling, then execute the harness binary against those fixtures on the same host.
Archives authored on Windows or macOS and extracted on Linux. Zip entries can carry a trailing space in their name from the originating platform; a build or install script that chmods and runs an extracted helper under that preserved name reproduces this pattern as inherited metadata rather than an intentional trick.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036, evaluated against their process_creation events.

Share this rule

/u/siemphony/cfa60147-efdc-4721-90fc-e84d29d88fc9

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable path uses RLO or trailing-space filename trick

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Wazuh · XML rule

Elastic · ES|QL

Community

Verdicts from engineers who deployed it