{"id":"T1036.002","name":"Right-to-Left Override","url":"https://attack.mitre.org/techniques/T1036/002","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0527","stix_id":"x-mitre-detection-strategy--c3c32822-80b2-4399-8e82-15cefaa80333","name":"Right-to-Left Override Masquerading Detection via Filename and Execution Context","url":"https://attack.mitre.org/detectionstrategies/DET0527","analytics":[{"id":"AN1461","stix_id":"x-mitre-analytic--fb330f70-f0f4-4a5b-9b91-37d29a097a4c","name":"Analytic 1461","description":"Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.","url":"https://attack.mitre.org/detectionstrategies/DET0527#AN1461","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Windows Defender","channel":"Operational","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-windows-defender"}],"mutable_elements":[{"field":"FilenamePattern","description":"RTLO variants such as \\u202E, %E2%80%AE, or byte-encoded forms"},{"field":"ExecutionContext","description":"Allows tuning for untrusted sources, e.g., browser downloads or email attachments"},{"field":"TimeWindow","description":"Defines correlation between file creation and process execution"}],"live":true,"detection_strategies":["DET0527"],"techniques":["T1036.002"]},{"id":"AN1462","stix_id":"x-mitre-analytic--667326a7-1f31-4ef1-92c1-6cb5241dadcf","name":"Analytic 1462","description":"Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.","url":"https://attack.mitre.org/detectionstrategies/DET0527#AN1462","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"subsystem=com.apple.lsd","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"fs:quarantine","channel":"/var/log/quarantine.log","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"fs-quarantine"}],"mutable_elements":[{"field":"FilenameDisplay","description":"Whether user-facing tools display the spoofed name or the true extension"},{"field":"GatekeeperBypassFlag","description":"Whether the execution bypassed translocation or quarantine checks"},{"field":"UserContext","description":"Scope detection to untrusted or non-admin users"}],"live":true,"detection_strategies":["DET0527"],"techniques":["T1036.002"]},{"id":"AN1463","stix_id":"x-mitre-analytic--7a72f91d-9c16-4724-b87d-3e5448f81b51","name":"Analytic 1463","description":"Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.","url":"https://attack.mitre.org/detectionstrategies/DET0527#AN1463","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"event-based","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"linux-osquery"},{"name":"desktop:file_manager","channel":"nautilus, dolphin, or gvfs logs","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"desktop-file-manager"}],"mutable_elements":[{"field":"ExtensionMismatch","description":"Filter based on mismatched visible extension vs. magic bytes or mime-type"},{"field":"ProcessLineage","description":"Correlation between file open and subsequent script interpreter invocation"},{"field":"FilenameEntropy","description":"Suspicious Unicode sequences or byte entropy in filenames"}],"live":true,"detection_strategies":["DET0527"],"techniques":["T1036.002"]}],"live":true,"version":"1.0","techniques":["T1036.002"]}],"sigma_rules":[{"id":"979baf41-ca44-4540-9d0c-4fcef3b5a3a4","title":"Potential File Extension Spoofing Using Right-to-Left Override","author":"Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2024-11-17","modified":"2026-03-20","description":"Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.\n","references":["https://redcanary.com/blog/right-to-left-override/","https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method","https://tria.ge/241015-l98snsyeje/behavioral2","https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.stealth","attack.t1036.002"],"path":"rules/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml","techniques":["T1036.002"],"cves":[]},{"id":"9cfe4b27-1e56-48b4-b7a8-d46851c91a44","title":"MMC Executing Files with Reversed Extensions Using RTLO Abuse","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-05","modified":null,"description":"Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.","references":["https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf","https://en.wikipedia.org/wiki/Right-to-left_override","https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1204.002","attack.t1218.014","attack.t1036.002"],"path":"rules/windows/process_creation/proc_creation_win_mmc_rlo_abuse_pattern.yml","techniques":["T1204.002","T1218.014","T1036.002"],"cves":[]},{"id":"ad691d92-15f2-4181-9aa4-723c74f9ddc3","title":"Potential Defense Evasion Via Right-to-Left Override","author":"Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux","status":"test","level":"high","date":"2023-02-15","modified":"2026-03-20","description":"Detects the presence of the \"u202+E\" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.\nThis character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.\n","references":["https://redcanary.com/blog/right-to-left-override/","https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method","https://unicode-explorer.com/c/202E","https://tria.ge/241015-l98snsyeje/behavioral2","https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.002"],"path":"rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml","techniques":["T1036.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}