Sigma rule: Potential Homoglyph Attack Using Lookalike Characters in Filename

Rule

Title

Potential Homoglyph Attack Using Lookalike Characters in Filename

Status

test

Level

medium

Author

Micah Babinski, @micahbabinski

Date

2023-05-08

File

rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.

Log source

product

windows

category

file_event

Detection

selection_upper:
    TargetFilename|contains:
        - "\u0410" # А/A
        - "\u0412" # В/B
        - "\u0415" # Е/E
        - "\u041a" # К/K
        - "\u041c" # М/M
        - "\u041d" # Н/H
        - "\u041e" # О/O
        - "\u0420" # Р/P
        - "\u0421" # С/C
        - "\u0422" # Т/T
        - "\u0425" # Х/X
        - "\u0405" # Ѕ/S
        - "\u0406" # І/I
        - "\u0408" # Ј/J
        - "\u04ae" # Ү/Y
        - "\u04c0" # Ӏ/I
        - "\u050C" # Ԍ/G
        - "\u051a" # Ԛ/Q
        - "\u051c" # Ԝ/W
        - "\u0391" # Α/A
        - "\u0392" # Β/B
        - "\u0395" # Ε/E
        - "\u0396" # Ζ/Z
        - "\u0397" # Η/H
        - "\u0399" # Ι/I
        - "\u039a" # Κ/K
        - "\u039c" # Μ/M
        - "\u039d" # Ν/N
        - "\u039f" # Ο/O
        - "\u03a1" # Ρ/P
        - "\u03a4" # Τ/T
        - "\u03a5" # Υ/Y
        - "\u03a7" # Χ/X
selection_lower:
    TargetFilename|contains:
        - "\u0430" # а/a
        - "\u0435" # е/e
        - "\u043e" # о/o
        - "\u0440" # р/p
        - "\u0441" # с/c
        - "\u0445" # х/x
        - "\u0455" # ѕ/s
        - "\u0456" # і/i
        - "\u04cf" # ӏ/l
        - "\u0458" # ј/j
        - "\u04bb" # һ/h
        - "\u0501" # ԁ/d
        - "\u051b" # ԛ/q
        - "\u051d" # ԝ/w
        - "\u03bf" # ο/o
condition: 1 of selection_*

False positives (as the rule lists them)

• File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use.

Tags

• attack.stealth
• attack.t1036
• attack.t1036.003

MITRE ATT&CK ids this rule names

• T1036
• T1036.003

References

• https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
• http://www.irongeek.com/homoglyph-attack-generator.php

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml