AN1461
Analytic 1461
Windows
Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Windows Defender
Operational
[FilenamePattern]
RTLO variants such as \u202E, %E2%80%AE, or byte-encoded forms
[ExecutionContext]
Allows tuning for untrusted sources, e.g., browser downloads or email attachments
[TimeWindow]
Defines correlation between file creation and process execution
AN1462
Analytic 1462
macOS
Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.
macos:unifiedlog
subsystem=com.apple.lsd
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
fs:quarantine
/var/log/quarantine.log
[FilenameDisplay]
Whether user-facing tools display the spoofed name or the true extension
[GatekeeperBypassFlag]
Whether the execution bypassed translocation or quarantine checks
[UserContext]
Scope detection to untrusted or non-admin users
AN1463
Analytic 1463
Linux
Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.
auditd:SYSCALL
execve
linux:osquery
event-based
desktop:file_manager
nautilus, dolphin, or gvfs logs
[ExtensionMismatch]
Filter based on mismatched visible extension vs. magic bytes or mime-type
[ProcessLineage]
Correlation between file open and subsequent script interpreter invocation
[FilenameEntropy]
Suspicious Unicode sequences or byte entropy in filenames