Evasion: Suspicious use of Unicode tag characters

 1name: "Evasion: Suspicious use of Unicode tag characters"
 2description: "Unicode Tag Block characters (U+E0000–U+E007F) render invisibly in mail clients but map 1:1 to ASCII at a 0xE0000 offset. Attackers use them two ways: to smuggle hidden instructions that LLM-powered email assistants will read and act on, and to interleave invisible characters through visible text to defeat content matching. This rule flags either use in the subject, body, or a calendar attachment, discounting the England, Scotland, and Wales subdivision flag emoji, which are legitimately built from tag characters."
 3type: "rule"
 4severity: "medium"
 5references:
 6  - "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/"
 7  - "https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/"
 8source: |
 9  type.inbound
10  and any([subject.subject, body.html.inner_text],
11          regex.count(., '[\x{E0020}-\x{E007E}]') > 10
12          and (
13            regex.contains(., '[A-Za-z0-9][\x{E0020}-\x{E007E}]+[A-Za-z0-9]')
14            or regex.contains(., '[\x{E0020}-\x{E007E}]{10,}')
15          )
16  )  
17tags:
18 - "Attack surface reduction"
19attack_types:
20  - "BEC/Fraud"
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Evasion"
24  - "Social engineering"
25detection_methods:
26  - "Content analysis"
27  - "HTML analysis"
28  - "Header analysis"
29id: "45a895a6-b1ba-53d1-9116-7c3cf21c4e99"