Elastic Security Detection Rules

File with Right-to-Left Override Character (RTLO) Created/Executed

Last updated 9 days ago on 2025-01-22
Created 11 days ago on 2025-01-20

About

Identifies the creation or execution of files or processes with names containing the Right-to-Left Override (RTLO) character, which can be used to disguise the file extension and trick users into executing malicious files.
Tags
Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Defense EvasionData Source: Elastic EndgameData Source: Elastic DefendData Source: SysmonData Source: Microsoft Defender for EndpointData Source: SentinelOneLanguage: eql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Masquerading (T1036)(opens in a new tab or window)

Execution (TA0002)(opens in a new tab or window)

↳ User Execution (T1204)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
winlogbeat-*logs-endpoint.events.process-*logs-endpoint.events.file-*logs-windows.sysmon_operational-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*endgame-*
Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

m365_defender(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

Query
any where host.os.type == "windows" and event.category in ("file", "process") and 
  (
    (event.type == "creation" and file.path : "*\u{202E}*") or 
    (event.type == "start" and process.name : "*\u{202E}*")
  )

Install detection rules in Elastic Security

Detect File with Right-to-Left Override Character (RTLO) Created/Executed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).