id: cbcffc11-0c7f-4753-9cdb-10d36b553a02
description: The user double clicked on a file named Annexe.jpeg, whose actual filename was Ann[U+202E]gepj.exe (using an RTLO character).
date: 2026-03-20
author: Luc Génaux
rule_metadata:
    - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3
      title: Potential Defense Evasion Via Right-to-Left Override
regression_tests_info:
    - name: Positive Detection Test
      type: evtx
      provider: Microsoft-Windows-Sysmon
      path: regression_data/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override/ad691d92-15f2-4181-9aa4-723c74f9ddc3.evtx
