{"id":"4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6","title":"Potential Homoglyph Attack Using Lookalike Characters in Filename","description":"Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\nThis is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\nare indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\n","author":"Micah Babinski, @micahbabinski","status":"test","level":"medium","date":"2023-05-08","modified":"","tags":["attack.stealth","attack.t1036","attack.t1036.003"],"technique_ids":["T1036","T1036.003"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use."],"references":["https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish","http://www.irongeek.com/homoglyph-attack-generator.php"],"source_path":"rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml","source_sha256":"c0e0bf44b9f4162084678f3047b32b207bd0a45d0ab188936b58baddba603be4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Homoglyph Attack Using Lookalike Characters in Filename\nid: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6\nstatus: test\ndescription: |\n    Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\n    This is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\n    are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\nreferences:\n    - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish\n    - http://www.irongeek.com/homoglyph-attack-generator.php\nauthor: Micah Babinski, @micahbabinski\ndate: 2023-05-08\ntags:\n    - attack.stealth\n    - attack.t1036\n    - attack.t1036.003\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_upper:\n        TargetFilename|contains:\n            - \"\\u0410\" # А/A\n            - \"\\u0412\" # В/B\n            - \"\\u0415\" # Е/E\n            - \"\\u041a\" # К/K\n            - \"\\u041c\" # М/M\n            - \"\\u041d\" # Н/H\n            - \"\\u041e\" # О/O\n            - \"\\u0420\" # Р/P\n            - \"\\u0421\" # С/C\n            - \"\\u0422\" # Т/T\n            - \"\\u0425\" # Х/X\n            - \"\\u0405\" # Ѕ/S\n            - \"\\u0406\" # І/I\n            - \"\\u0408\" # Ј/J\n            - \"\\u04ae\" # Ү/Y\n            - \"\\u04c0\" # Ӏ/I\n            - \"\\u050C\" # Ԍ/G\n            - \"\\u051a\" # Ԛ/Q\n            - \"\\u051c\" # Ԝ/W\n            - \"\\u0391\" # Α/A\n            - \"\\u0392\" # Β/B\n            - \"\\u0395\" # Ε/E\n            - \"\\u0396\" # Ζ/Z\n            - \"\\u0397\" # Η/H\n            - \"\\u0399\" # Ι/I\n            - \"\\u039a\" # Κ/K\n            - \"\\u039c\" # Μ/M\n            - \"\\u039d\" # Ν/N\n            - \"\\u039f\" # Ο/O\n            - \"\\u03a1\" # Ρ/P\n            - \"\\u03a4\" # Τ/T\n            - \"\\u03a5\" # Υ/Y\n            - \"\\u03a7\" # Χ/X\n    selection_lower:\n        TargetFilename|contains:\n            - \"\\u0430\" # а/a\n            - \"\\u0435\" # е/e\n            - \"\\u043e\" # о/o\n            - \"\\u0440\" # р/p\n            - \"\\u0441\" # с/c\n            - \"\\u0445\" # х/x\n            - \"\\u0455\" # ѕ/s\n            - \"\\u0456\" # і/i\n            - \"\\u04cf\" # ӏ/l\n            - \"\\u0458\" # ј/j\n            - \"\\u04bb\" # һ/h\n            - \"\\u0501\" # ԁ/d\n            - \"\\u051b\" # ԛ/q\n            - \"\\u051d\" # ԝ/w\n            - \"\\u03bf\" # ο/o\n    condition: 1 of selection_*\nfalsepositives:\n    - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"},{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"}],"data_path":"data/detection-rules/4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6.json","kind":"sigma"}