Attachment: Suspicious use of Unicode tag characters in ICS File

 1name: "Attachment: Suspicious use of Unicode tag characters in ICS File"
 2description: "Unicode Tag Block characters (U+E0000–U+E007F) render invisibly in mail clients but map 1:1 to ASCII at a 0xE0000 offset. Attackers use them two ways: to smuggle hidden instructions that LLM-powered email assistants will read and act on, and to interleave invisible characters through visible text to defeat content matching. This rule flags either use in the subject, body, or a calendar attachment, discounting the England, Scotland, and Wales subdivision flag emoji, which are legitimately built from tag characters."
 3type: "rule"
 4severity: "medium"
 5references:
 6  - "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/"
 7  - "https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/"
 8source: |
 9  type.inbound
10  and any(filter(attachments,
11                 .file_type == "ics"
12                 or (
13                   .file_extension == "ics"
14                   or .content_type in ("application/ics", "text/calendar")
15                 )
16          ),
17          regex.count(file.parse_text(.).text, '[\x{E0020}-\x{E007E}]') > 10
18          and (
19            regex.contains(file.parse_text(.).text,
20                           '[A-Za-z0-9][\x{E0020}-\x{E007E}]+[A-Za-z0-9]'
21            )
22            or regex.contains(file.parse_text(.).text,
23                              '[\x{E0020}-\x{E007E}]{10,}'
24            )
25          )
26  )  
27tags:
28 - "Attack surface reduction"
29attack_types:
30  - "BEC/Fraud"
31  - "Credential Phishing"
32tactics_and_techniques:
33  - "Evasion"
34  - "Social engineering"
35detection_methods:
36  - "Content analysis"
37  - "HTML analysis"
38  - "Header analysis"
39id: "56a0d5c9-a9d5-5fef-84af-c9340cd08e3f"