T1036.002sub-technique of T1036 Masquerading

Right-to-Left Override

Linux · macOS · Windowsnothing on this site yetT1036.002 on attack.mitre.org

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named `March 25 \u202Excod.scr` will display as `March 25 rcs.docx`.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Right-to-Left Override Masquerading Detection via Filename and Execution Context

Execution of files containing right-to-left override characters (U+202E) to masquerade true file extensions. Often found in phishing payloads or file downloads.
Execution of files with reversed filename extensions using Unicode RTLO character. Frequently used to deceive Gatekeeper and users in Safari or Mail-based phishing.
Execution of user-downloaded or created scripts with hidden extensions due to RTLO character insertion in filename, often present in desktop environments or phishing campaigns.

the rest of T1036

T1036.001 Invalid Code Signature · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.004 Masquerade Task or Service · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.006 Space after Filename · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.008 Masquerade File Type · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.011 Overwrite Process Arguments · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.