T1036.002 — Right-to-Left Override

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable…

Sub-technique of Masquerading (T1036).

Sigma detection rules (3)

T1036.002 Masquerading: Right-to-Left Override

title: "T1036.002 Masquerading: Right-to-Left Override"
id: a856368d-c045-44c5-bc35-8cb6b934ca0f
description: 'Detects the actual Unicode RTLO character (U+202E) in process image path or command line. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: FilenamePattern, ExecutionContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1036/002
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.stealth
  - attack.t1036.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_rtlo_image:
    Image|contains: "\u202E"
  selection_rtlo_cmdline:
    CommandLine|contains: "\u202E"
  condition: 1 of selection_*

falsepositives:
  - Extremely rare.

level: high

T1036.002 Masquerading: Right-to-Left Override

title: "T1036.002 Masquerading: Right-to-Left Override"
id: ec2170dd-7011-41e8-a200-6debc70f331c
description: 'Right-to-Left Override Masquerading Detection via Filename and Execution Context. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExtensionMismatch, ProcessLineage, FilenameEntropy.'
references:
  - https://attack.mitre.org/techniques/T1036/002
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.stealth
  - attack.t1036.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|contains: '‮'
  condition: selection

falsepositives:
  - Extremely rare in legitimate Linux administration, but auditd/EXECVE argv logging of raw Unicode bytes depends on audit daemon encoding configuration and may not reliably surface the RLO codepoint.

level: high

T1036.002 Masquerading: Right-to-Left Override

title: "T1036.002 Masquerading: Right-to-Left Override"
id: 9f134c45-9fec-4d6f-8576-6ece9c5fe856
description: 'Right-to-Left Override Masquerading Detection via Filename and Execution Context. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilenameDisplay, GatekeeperBypassFlag, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1036/002
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.stealth
  - attack.t1036.002

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains: "\u202E"
  condition: selection

falsepositives:
  - Rare legitimate use of bidirectional text formatting in filenames for right-to-left language support.

level: medium

Related sub-techniques

Explore