cyberstrikeus T1036.002 Right-to-Left Override
Sub-technique of: T1036
High-Level Description
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.
Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity. RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Linux, macOS, Windows
What to Check
- Identify if Right-to-Left Override technique is applicable to target environment
- Check Linux systems for indicators of Right-to-Left Override
- Check macOS systems for indicators of Right-to-Left Override
- Check Windows systems for indicators of Right-to-Left Override
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to Right-to-Left Override by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1036.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Right-to-Left Override Masquerading Detection via Filename and Execution Context
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Right-to-Left Override technique applicable | High | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |