Evasion: Suspicious use of Unicode tag characters

name: "Evasion: Suspicious use of Unicode tag characters"
description: "Unicode Tag Block characters (U+E0000–U+E007F) render invisibly in mail clients but map 1:1 to ASCII at a 0xE0000 offset. Attackers use them two ways: to smuggle hidden instructions that LLM-powered email assistants will read and act on, and to interleave invisible characters through visible text to defeat content matching. This rule flags either use in the subject, body, or a calendar attachment, discounting the England, Scotland, and Wales subdivision flag emoji, which are legitimately built from tag characters."
type: "rule"
severity: "medium"
references:
  - "https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/"
  - "https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/"
source: |
  type.inbound
  and any([subject.subject, body.html.inner_text],
          regex.count(., '[\x{E0020}-\x{E007E}]') > 10
          and (
            regex.contains(., '[A-Za-z0-9][\x{E0020}-\x{E007E}]+[A-Za-z0-9]')
            or regex.contains(., '[\x{E0020}-\x{E007E}]{10,}')
          )
  )
tags:
 - "Attack surface reduction"
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "Header analysis"
id: "45a895a6-b1ba-53d1-9116-7c3cf21c4e99"