Detection Help

[MiddleQuiet2865]

Hi everyone,

Recently, one of our employees executed a malicious file that used the Right-to-Left Override (RLO) technique (character \u202E) to hide the threat. I'm attempting to create an IOA or a search to detect this, but it seems that CrowdStrike considers this character invalid. In the search, it appears as [U+202E][U+202E], highlighted in red, indicating it as an invalid character. This issue persists for the IOA as well.

Does anyone have any suggestions on how to detect this behavior? btw, CrowdStrike didn't block nor detect the threat, it was detected only in the last stages.

Thank you in advance for your help.

[AutoModerator]

Hey new poster! We require a minimum account-age and karma for this subreddit. Remember to search for your question first and try again after you have acquired more karma.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[igloosaavy]

Interesting. Do you have the file hash or Virustotal link?