MMC Executing Files with Reversed Extensions Using RTLO Abuse — Detection Rule
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.