Invisible Unicode code point rebuilt in a PowerShell script block

1title: Invisible Unicode code point rebuilt in a PowerShell script block2id: 7eb2f807-be72-40db-9998-122dcdc1c2963status: experimental4description: |5  MITRE's analytic describes a script that looks benign because its payload is6  written in characters that do not render, and is reconstructed and evaluated at7  runtime. Script Block Logging is the only log source in the strategy that shows8  the script text itself, so this rule requires two things in one 4104 block: a9  literal reference to one of the zero-width, word-joiner, right-to-left-override10  or byte-order-mark code points, and a dynamic-execution or decode call. Both the11  0x200B literal and the backslash-u escape are matched, since both leave the12  hex value in the text; the U+200B documentation form is deliberately not, as it13  appears in comments and prose far more often than in an executable payload.14  What the rule cannot do is measure MITRE's UnicodeDensityThreshold — a script15  carrying the raw invisible characters rather than naming their code points is16  invisible to a text match, so this catches the constructor, not the payload.17  Script Block Logging is off in a default install and in the MS and CIS18  baselines; without it the PowerShell channel carries no ScriptBlockText at all.19  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0920, not hand-written and not tested by its author. Any lab result is on this rule's own page.20references:21  - https://attack.mitre.org/techniques/T1027/01822  - https://attack.mitre.org/detectionstrategies/DET092023author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)24date: 2026-08-1625tags:26  - attack.defense-evasion27  - attack.t1027.01828logsource:29  product: windows30  service: powershell31detection:32  selection_event:33    EventID: 410434  selection_codepoint:35    ScriptBlockText|contains:36      - '0x200b'37      - '0x200c'38      - '0x200d'39      - '0x2060'40      - '0x202e'41      - '0xfeff'42      - 'u200b'43      - 'u200c'44      - 'u200d'45      - 'u2060'46      - 'u202e'47      - 'ufeff'48  selection_dynamic:49    ScriptBlockText|contains:50      - 'Invoke-Expression'51      - 'IEX('52      - 'IEX ('53      - 'FromBase64String'54      - '[scriptblock]::Create'55  condition: selection_event and selection_codepoint and selection_dynamic56falsepositives:57  - "Large modules logged as a single script block, where one function strips a byte-order mark or a zero-width space from imported text and an unrelated function decodes base64. Sigma has no proximity operator, so the two halves need not be connected in any way for the rule to fire, and this is the most likely benign hit on a host that runs sizeable PowerShell modules."58  - "Text-normalisation, localisation and right-to-left handling code, which names 0x202E and the zero-width joiners on purpose to sanitise or render user-supplied strings correctly."59  - "Obfuscation research, security training material and detection-validation suites, which construct zero-width payloads and evaluate them precisely because that is the behaviour being demonstrated."60  - "Installer and packaging scripts that embed a base64 blob and clean up encoding artefacts in the same block. MITRE's ExecutionContext knob is the intended tuning point here, but 4104 records the interpreter that logged the block rather than a distinct execution context, so scoping has to be done on the host or the calling user."61level: medium