sublimemediumRule

Evasion: Variation selectors in subject line

Detects inbound messages where invisible Unicode variation selector characters (U+FE00–U+FE0D) are inserted immediately after alphanumeric characters in the subject line. This technique is used to break up recognizable words or phrases at the character level, allowing the text to render normally to recipients while evading keyword-based or pattern-matching detection systems.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1036 T1027

defense-evasion

Detection Query

type.inbound
and regex.contains(subject.base, '[A-Za-z0-9][\x{FE00}-\x{FE0D}]')

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Evasion: Variation selectors in subject line"
description: "Detects inbound messages where invisible Unicode variation selector characters (U+FE00–U+FE0D) are inserted immediately after alphanumeric characters in the subject line. This technique is used to break up recognizable words or phrases at the character level, allowing the text to render normally to recipients while evading keyword-based or pattern-matching detection systems."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and regex.contains(subject.base, '[A-Za-z0-9][\x{FE00}-\x{FE0D}]')
attack_types:
  - "Spam"
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Content analysis"
id: "39779945-7b08-5240-a9c6-bb55fb57c064"