How to detect T1036.002: Masquerading (Right-to-Left Override)?

[jrock]

Hi all,

Recently I have been working on getting a query that can help me identify the execution of malicious documents which make use of "T1036.002: Masquerading (Right-to-Left Override)". 

"Adversaries may manipulate features of an artifact to mask its true intentions/make it seem legitimate. One technique that could be employed to achieve this is right-to-left character override (RTLO). RTLO is a non-printing Unicode character that causes the text that follows to be displayed in reverse.

Detection of this technique involves monitoring filenames for commonly used RTLO character formats such as \u202E, [U+202E], and %E2%80%AE."

My current query does not work and simply shows all file names from the Image field:
index=*
| eval file_name=replace(Image,"(.*\\\)","")
| rex field=file_name "(?i)(?<hex_field>202e)" | search NOT (hex_field="")
| dedup file_name
| table file_name, hex_field, Image

Image Field: C:\Users\Administrator.BARTERTOWNGROUP\Desktop\‮cod.3aka3.scr

Note here that the rcs.3aka3.doc is RTL not LTR. Does anyone have any idea how to achieve such filtering?

[cbr654]

Not joking .  I was going about this the hard way and wasted so much time , but this worked 

index=sysmon  <U+202E>   ( This is invisible . You will not see it when you paste it in Splunk)
| stats .. ( your query)  

In sysmon the CommandLine and Targetfilename is were you would see the RTLO operation

[cbr654]

Hey jrock,
I figured it out.  Copy and past the invisible character (U+202E) from the character map into Splunk. You will not see it, but it this there. Put the rest of your query afterwards.  

[jrock]

Hi CBR

Must be a joke o.o?

Would you mind sharing the query you have, or a simplified anonymized version. As I tried this myself but I couldn't get it to work.

[cbr654]

Hey jrock, were you able to figure this out. i am looking for a solution as well. Thanks!

[jrock]

Hey cbr!

Unfortunately I was not yet able to find any query that does exactly this. Hoped the community would be able to help, but I think this is either an under rated approach to gain a foothold on the network, or it is not possible.