Sub-technique of T1036 Masquerading.View on attack.mitre.org
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.
Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity. RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Rules on DetectionCode tagged with T1036.002.
| Rule | Level | Log source |
|---|---|---|
| MMC Executing Files with Reversed Extensions Using RTLO Abuse | high | windows / process_creation |
| Potential Defense Evasion Via Right-to-Left Override | high | windows / process_creation |
| Potential File Extension Spoofing Using Right-to-Left Override | high | windows / file_event |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Detect RTLO In File Name | TTP | NULL | Sysmon EventID 11 |
| Detect RTLO In Process | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupBlackTech | BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments. |
| GroupBRONZE BUTLER | BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware. |
| GroupFerocious Kitten | Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones. |
| GroupKe3chang | Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files. |
| GroupScarlet Mimic | Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
