Ferocious KittenG0137 ↗
Has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.1
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 10 February 2020
- Last modified
- 12 May 2026
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Right-to-Left Override MITRE reference T1036.002
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackTechG0098 ↗
Has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.1
BRONZE BUTLERG0060 ↗
Has used Right-to-Left Override to deceive victims into executing several strains of malware.1
Scarlet MimicG0029 ↗
Has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.1
Ke3changG0004 ↗
Has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.1
All 5 groups for this technique
Offense vs defense T1036.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2
first rule: 2023 Q1Right-to-Left Override detection strategy DET0527
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Right-to-Left Override Masquerading Detection via Filename and Execution Context
3 platforms
AN1461 · Windows
Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File MetadataDC0059 | WinEventLog:Windows Defender | Operational |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenamePattern | RTLO variants such as \u202E, %E2%80%AE, or byte-encoded forms |
| ExecutionContext | Allows tuning for untrusted sources, e.g., browser downloads or email attachments |
| TimeWindow | Defines correlation between file creation and process execution |
AN1462 · macOS
Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| File AccessDC0055 | fs:quarantine | /var/log/quarantine.log |
| File MetadataDC0059 | macos:unifiedlog | subsystem=com.apple.lsd |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenameDisplay | Whether user-facing tools display the spoofed name or the true extension |
| GatekeeperBypassFlag | Whether the execution bypassed translocation or quarantine checks |
| UserContext | Scope detection to untrusted or non-admin users |
AN1463 · Linux
Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | desktop:file_manager | nautilus, dolphin, or gvfs logs |
| File MetadataDC0059 | linux:osquery | event-based |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExtensionMismatch | Filter based on mismatched visible extension vs. magic bytes or mime-type |
| ProcessLineage | Correlation between file open and subsequent script interpreter invocation |
| FilenameEntropy | Suspicious Unicode sequences or byte entropy in filenames |
Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites0Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition