Detectionhightest

Potential Defense Evasion Via Right-to-Left Override

Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Micah Babinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc GénauxCreated Wed Feb 15Updated Fri Mar 20ad691d92-15f2-4181-9aa4-723c74f9ddc3windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains:
            - '\u202e'  # Unicode RTLO character
            - '[U+202E]'
            # Real char U+202E copied/pasted below
            - '‮'
    condition: selection
False Positives

Commandlines that contains scriptures such as arabic or hebrew might make use of this character

Testing & Validation

Regression Tests

by Luc Génaux
Positive Detection Testevtx

Microsoft-Windows-Sysmon