T1027.018 — Invisible Unicode

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.018 Obfuscated Files or Information: Invisible Unicode

title: "T1027.018 Obfuscated Files or Information: Invisible Unicode"
id: d6cbd7dc-a550-40d3-aee2-7ad10d619e4b
description: 'Detects invisible/non-printing Unicode code points (zero-width and format characters) embedded in logged PowerShell script content, the concealment mechanism this technique relies on. (Retargeted to PowerShell Script Block Logging (EventID 4104) telemetry, since process_creation CommandLine cannot see script body content.) Tune using: UnicodeCodepointAllowlist, ScriptBlockLengthThreshold, UnicodeDensityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1027/018
author: Shahrukh Khan
date: 2026-03-03
license: MIT
tags:
  - attack.stealth
  - attack.t1027.018

logsource:
  product: windows
  category: ps_script

detection:
  selection:
    ScriptBlockText|contains:
      - "\u200B"
      - "\u200C"
      - "\u200D"
      - "\u2060"
      - "\uFEFF"
      - "\u180E"
      - "\u2061"
      - "\u2062"
      - "\u2063"
      - "\u2064"

  condition: selection

falsepositives:
  - Rare — legitimate scripts do not normally contain zero-width or invisible format characters; some localization/i18n libraries or copy-pasted text with a stray BOM/zero-width joiner may trigger, tune with UnicodeCodepointAllowlist.

level: high

T1027.018 Obfuscated Files or Information: Invisible Unicode

title: "T1027.018 Obfuscated Files or Information: Invisible Unicode"
id: d400cf2d-3967-4e09-9ee5-2da43a6ce9f4
description: 'Detects invisible/zero-width Unicode code points (e.g. U+200B zero-width space, U+2060 word joiner, U+FEFF BOM, U+202E right-to-left override, U+180E Mongolian vowel separator) appearing inside process command-line arguments captured by auditd EXECVE records. auditd hex-encodes argument bytes that are non-printable or contain special characters, so these code points surface as recognizable UTF-8 hex byte sequences (e.g. e2808b) inside the a0/a1/... fields. This only covers invisible Unicode used within command-line arguments passed to execve(); it cannot see invisible Unicode hidden inside the contents of a script or document file that is merely opened/read, since auditd does not capture file content. Tune using: DecodeUtility, EntropyThreshold (retained for compatibility, not used by the corrected logic below).'
references:
  - https://attack.mitre.org/techniques/T1027/018
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.stealth
  - attack.t1027.018

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_exec:
    type: EXECVE
  selection_invisible:
    - a0|contains:
        - 'e2808b'
        - 'e2808c'
        - 'e2808d'
        - 'e281a0'
        - 'efbbbf'
        - 'e280ae'
        - 'e1a08e'
    - a1|contains:
        - 'e2808b'
        - 'e2808c'
        - 'e2808d'
        - 'e281a0'
        - 'efbbbf'
        - 'e280ae'
        - 'e1a08e'
    - a2|contains:
        - 'e2808b'
        - 'e2808c'
        - 'e2808d'
        - 'e281a0'
        - 'efbbbf'
        - 'e280ae'
        - 'e1a08e'
    - a3|contains:
        - 'e2808b'
        - 'e2808c'
        - 'e2808d'
        - 'e281a0'
        - 'efbbbf'
        - 'e280ae'
        - 'e1a08e'
  condition: selection_exec and selection_invisible

falsepositives:
  - Rare -- most shells and legitimate tooling never embed zero-width or bidi-override code points in argv; a hit strongly warrants review, but internationalized filenames/arguments using other multibyte UTF-8 sequences not in the above list will not match.

level: medium

T1027.018 Obfuscated Files or Information: Invisible Unicode

title: "T1027.018 Obfuscated Files or Information: Invisible Unicode"
id: 96e5927e-704c-4ac9-b803-ece7baa14278
description: 'Detection Strategy for Invisible Unicode. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionContext, UnicodeCharacterSet.'
references:
  - https://attack.mitre.org/techniques/T1027/018
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.stealth
  - attack.t1027.018

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    DestinationHostname|contains: 'xn--'
  condition: selection

falsepositives:
  - Legitimate internationalized domain names using punycode encoding for non-Latin scripts.

level: medium

Related sub-techniques

Explore