Evasion: Zero-width character stuffing in subject or sender name
Flags inbound messages containing links or attachments where the subject line or sender display name contains 10 or more invisible unicode characters (such as zero-width spaces, soft hyphens, zero-width joiners, or byte order marks), a technique used to evade text-based detection engines. Messages from highly trusted sender domains that pass DMARC authentication are excluded.
Sublime rule (View on GitHub)
1name: "Evasion: Zero-width character stuffing in subject or sender name"
2description: "Flags inbound messages containing links or attachments where the subject line or sender display name contains 10 or more invisible unicode characters (such as zero-width spaces, soft hyphens, zero-width joiners, or byte order marks), a technique used to evade text-based detection engines. Messages from highly trusted sender domains that pass DMARC authentication are excluded."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (length(body.links) > 0 or length(attachments) > 0)
8 and any([subject.subject, sender.display_name],
9 regex.icount(., '[\x{200B}-\x{200F}\x{00AD}\x{FEFF}\x{2060}]') >= 10
10 )
11
12 // negate highly trusted sender domains unless they fail DMARC authentication
13 and not (
14 sender.email.domain.root_domain in $high_trust_sender_root_domains
15 and coalesce(headers.auth_summary.dmarc.pass, false)
16 )
17tags:
18 - "Attack surface reduction"
19attack_types:
20 - "Credential Phishing"
21 - "Spam"
22tactics_and_techniques:
23 - "Evasion"
24detection_methods:
25 - "Content analysis"
26 - "Header analysis"
27id: "9342c8f9-8384-5dfb-945f-4f4438e6f32d"