Updated converted sigma rules for version version/7.1

Author: vastlimits

config/uberAgent-ESA-am-sigma-high-windows.conf

@@ -383,7 +383,7 @@ EventType = File.Create
 Tag = potential-file-extension-spoofing-using-right-to-left-override
 RiskScore = 75
 Annotation = {"mitre_attack": ["T1036.002"]}
-Query = (File.Path like r"%\\u202e%" or File.Path like r"%[U+202E]%") and (File.Path like r"%3pm.%" or File.Path like r"%4pm.%" or File.Path like r"%cod.%" or File.Path like r"%fdp.%" or File.Path like r"%ftr.%" or File.Path like r"%gepj.%" or File.Path like r"%gnp.%" or File.Path like r"%gpj.%" or File.Path like r"%ism.%" or File.Path like r"%lmth.%" or File.Path like r"%nls.%" or File.Path like r"%piz.%" or File.Path like r"%slx.%" or File.Path like r"%tdo.%" or File.Path like r"%vsc.%" or File.Path like r"%vwm.%" or File.Path like r"%xcod.%" or File.Path like r"%xslx.%" or File.Path like r"%xtpp.%")
+Query = (File.Path like r"%\\u202e%" or File.Path like r"%[U+202E]%" or File.Path like r"%‮%") and (File.Path like r"%3pm.%" or File.Path like r"%4pm.%" or File.Path like r"%cod.%" or File.Path like r"%fdp.%" or File.Path like r"%ftr.%" or File.Path like r"%gepj.%" or File.Path like r"%gnp.%" or File.Path like r"%gpj.%" or File.Path like r"%ism.%" or File.Path like r"%lmth.%" or File.Path like r"%nls.%" or File.Path like r"%piz.%" or File.Path like r"%slx.%" or File.Path like r"%tdo.%" or File.Path like r"%vsc.%" or File.Path like r"%vwm.%" or File.Path like r"%xcod.%" or File.Path like r"%xslx.%" or File.Path like r"%xtpp.%")
 GenericProperty1 = File.Path
 
 
@@ -1157,7 +1157,7 @@ EventType = File.Create
 Tag = suspicious-double-extension-files
 RiskScore = 75
 Annotation = {"mitre_attack": ["T1036.007"]}
-Query = (File.Path like r"%.exe" or File.Path like r"%.iso" or File.Path like r"%.rar" or File.Path like r"%.svg" or File.Path like r"%.zip") and (File.Path like r"%.doc.%" or File.Path like r"%.docx.%" or File.Path like r"%.gif.%" or File.Path like r"%.jpeg.%" or File.Path like r"%.jpg.%" or File.Path like r"%.mp3.%" or File.Path like r"%.mp4.%" or File.Path like r"%.pdf.%" or File.Path like r"%.png.%" or File.Path like r"%.ppt.%" or File.Path like r"%.pptx.%" or File.Path like r"%.rtf.%" or File.Path like r"%.svg.%" or File.Path like r"%.txt.%" or File.Path like r"%.xls.%" or File.Path like r"%.xlsx.%") or File.Path like r"%.rar.exe" or File.Path like r"%.zip.exe"
+Query = ((File.Path like r"%.exe" or File.Path like r"%.iso" or File.Path like r"%.rar" or File.Path like r"%.svg" or File.Path like r"%.zip") and (File.Path like r"%.doc.%" or File.Path like r"%.docx.%" or File.Path like r"%.gif.%" or File.Path like r"%.jpeg.%" or File.Path like r"%.jpg.%" or File.Path like r"%.mp3.%" or File.Path like r"%.mp4.%" or File.Path like r"%.pdf.%" or File.Path like r"%.png.%" or File.Path like r"%.ppt.%" or File.Path like r"%.pptx.%" or File.Path like r"%.rtf.%" or File.Path like r"%.svg.%" or File.Path like r"%.txt.%" or File.Path like r"%.xls.%" or File.Path like r"%.xlsx.%") or File.Path like r"%.rar.exe" or File.Path like r"%.zip.exe") and not File.Path like r"/usr/share/icons/%"
 GenericProperty1 = File.Path
 
 
@@ -7897,15 +7897,15 @@ Query = (Process.CommandLine like r"%.DownloadString(%" or Process.CommandLine l
 
 [ActivityMonitoringRule platform=Windows]
 # Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
-# This is used as an obfuscation and masquerading techniques.
-# Author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems)
+# This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.
+# Author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux
 RuleId = ad691d92-15f2-4181-9aa4-723c74f9ddc3
 RuleName = Potential Defense Evasion Via Right-to-Left Override
 EventType = Process.Start
 Tag = proc-start-potential-defense-evasion-via-right-to-left-override
 RiskScore = 75
 Annotation = {"mitre_attack": ["T1036.002"]}
-Query = Process.CommandLine like r"%\\u202e%" or Process.CommandLine like r"%[U+202E]%"
+Query = Process.CommandLine like r"%\\u202e%" or Process.CommandLine like r"%[U+202E]%" or Process.CommandLine like r"%‮%"
 
 
 [ActivityMonitoringRule platform=Windows]