MMC Executing Files with Reversed Extensions Using RTLO Abuse (9cfe4b27-1e56-48b4-b7a8-d46851c91a44)

Detects malicious behavior where the MMC utility (mmc.exe) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Right-to-Left Override - T1036.002 (77eae145-55db-4519-8ae5-77b0c7215d69)	Attack Pattern	MMC Executing Files with Reversed Extensions Using RTLO Abuse (9cfe4b27-1e56-48b4-b7a8-d46851c91a44)	Sigma-Rules	1
MMC Executing Files with Reversed Extensions Using RTLO Abuse (9cfe4b27-1e56-48b4-b7a8-d46851c91a44)	Sigma-Rules	MMC - T1218.014 (ffbcfdb0-de22-4106-9ed3-fc23c8a01407)	Attack Pattern	1
MMC Executing Files with Reversed Extensions Using RTLO Abuse (9cfe4b27-1e56-48b4-b7a8-d46851c91a44)	Sigma-Rules	Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	1
Right-to-Left Override - T1036.002 (77eae145-55db-4519-8ae5-77b0c7215d69)	Attack Pattern	Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	2
MMC - T1218.014 (ffbcfdb0-de22-4106-9ed3-fc23c8a01407)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Malicious File - T1204.002 (232b7f21-adf9-4b42-b936-b9d6f7df856e)	Attack Pattern	2