CmdID / Techniques / T1036

T1036.002 Masquerading: Right-to-Left Override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. MITRE ATT&CK

1 program on CmdID 2 Sigma rules T1036.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1036Masquerading

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

mmc.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highMMC Executing Files with Reversed Extensions Using RTLO AbuseSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highPotential Defense Evasion Via Right-to-Left OverrideMicah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux · Windows