ATT&CK technique
View on MITRE ATT&CK →
T1036.002
Right-to-Left Override
Stealth
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | File with Right-to-Left Override Character (RTLO) Created/Executed | production | 2026-09-18 |
| splunk | Detect RTLO In File Name | production | 2026-05-13 |
| splunk | Detect RTLO In Process | production | 2026-05-13 |
| sigma | Potential File Extension Spoofing Using Right-to-Left Override | test | 2026-03-20 |
| sigma | Potential Defense Evasion Via Right-to-Left Override | test | 2026-03-20 |
| sigma | MMC Executing Files with Reversed Extensions Using RTLO Abuse | experimental | 2025-02-05 |