Right-to-Left Override, or RTLO, is ATT&CK T1036.002. It is a Stealth technique that applies to Linux, macOS and Windows. The trick uses a single non-printing Unicode character, U+202E, which tells the display to render the text after it in reverse.
How attackers use it
MITRE gives two examples. A Windows screensaver executable named March 25 followed by the override character and the string excod.scr will display as March 25 rcs.docx. A JavaScript file with the override placed inside its name can be shown as a PNG image.
The point is to make a person believe they are opening a benign file type. MITRE notes the common pairing with spearphishing attachments and malicious file execution, because the trick can fool both end users and defenders who do not know how their tools render the character. It can also appear in the Windows Registry, where regedit.exe displays the reversed characters but the reg.exe command line tool does not by default. That means two views of the same object can disagree.
How to detect it
The MITRE detection strategy looks for execution of files whose names contain U+202E. The platform notes add context: on Windows and Linux, downloaded or user-created files and scripts with hidden extensions, and on macOS reversed extensions meant to deceive users, often in Safari or Mail based phishing.
Practical signals:
- Process creation events where the image path contains the code point U+202E.
- File creation events in downloads, temp and mail attachment folders with that character in the name.
- Tools that show raw bytes or escaped names, since a normal file listing may hide the problem.
On Linux or macOS you can search a folder for the character's UTF-8 bytes with a read-only command:
find . -name "*$(printf '\342\200\256')*"
How to reduce the risk
MITRE's page for this sub-technique lists no dedicated mitigations. The sensible controls come from the surrounding behavior: block or quarantine executable file types in email attachments, strip or flag the override character in file names at your mail gateway, and train people to be wary of attachments that open in an unexpected way. Showing the raw file name in your log pipeline helps analysts avoid being fooled the same way a user is.
