Detection rules › Sigma

MMC Executing Files with Reversed Extensions Using RTLO Abuse

Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects malicious behavior where the MMC utility (mmc.exe) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1204.002 User Execution: Malicious File
Defense EvasionT1036.002 Masquerading: Right-to-Left Override, T1218.014 System Binary Proxy Execution: MMC

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_image

or:
Image|endswith: '\mmc.exe'
OriginalFileName: MMC.exe

Stage 2: all of selection_commandline

or:
CommandLine|contains: cod.msc
CommandLine|contains: fdp.msc
CommandLine|contains: ftr.msc
CommandLine|contains: lmth.msc
CommandLine|contains: slx.msc
CommandLine|contains: tdo.msc
CommandLine|contains: xcod.msc
CommandLine|contains: xslx.msc
CommandLine|contains: xtpp.msc

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • cod.msc
  • fdp.msc
  • ftr.msc
  • lmth.msc
  • slx.msc
  • tdo.msc
  • xcod.msc
  • xslx.msc
  • xtpp.msc
Imageends_with
  • \mmc.exe corpus 6 (sigma 6)
OriginalFileNameeq
  • MMC.exe corpus 2 (sigma 2)