Invisible Unicode code point rebuilt in a PowerShell script block

Siemphony@siemphonymediumT1027.018unverified

MITRE's analytic describes a script that looks benign because its payload is written in characters that do not render, and is reconstructed and evaluated at runtime. Script Block Logging is the only log source in the strategy that shows the script text itself, so this rule requires two things in one 4104 block: a literal reference to one of the zero-width, word-joiner, right-to-left-override or byte-order-mark code points, and a dynamic-execution or decode call. Both the 0x200B literal and the backslash-u escape are matched, since both leave the hex value in the text; the U+200B documentation form is deliberately not, as it appears in comments and prose far more often than in an executable payload. What the rule cannot do is measure MITRE's UnicodeDensityThreshold — a script carrying the raw invisible characters rather than naming their code points is invisible to a text match, so this catches the constructor, not the payload. Script Block Logging is off in a default install and in the MS and CIS baselines; without it the PowerShell channel carries no ScriptBlockText at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0920, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "0x200b" or ScriptBlockText contains "0x200c" or ScriptBlockText contains "0x200d" or ScriptBlockText contains "0x2060" or ScriptBlockText contains "0x202e" or ScriptBlockText contains "0xfeff" or ScriptBlockText contains "u200b" or ScriptBlockText contains "u200c" or ScriptBlockText contains "u200d" or ScriptBlockText contains "u2060" or ScriptBlockText contains "u202e" or ScriptBlockText contains "ufeff")) and (ScriptBlockText contains "Invoke-Expression" or ScriptBlockText contains "IEX(" or ScriptBlockText contains "IEX (" or ScriptBlockText contains "FromBase64String" or ScriptBlockText contains "[scriptblock]::Create"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*0x200b*" OR ScriptBlockText="*0x200c*" OR ScriptBlockText="*0x200d*" OR ScriptBlockText="*0x2060*" OR ScriptBlockText="*0x202e*" OR ScriptBlockText="*0xfeff*" OR ScriptBlockText="*u200b*" OR ScriptBlockText="*u200c*" OR ScriptBlockText="*u200d*" OR ScriptBlockText="*u2060*" OR ScriptBlockText="*u202e*" OR ScriptBlockText="*ufeff*")) AND (ScriptBlockText="*Invoke-Expression*" OR ScriptBlockText="*IEX(*" OR ScriptBlockText="*IEX (*" OR ScriptBlockText="*FromBase64String*" OR ScriptBlockText="*[scriptblock]::Create*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*0x200b*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0x200c*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0x200d*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0x2060*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0x202e*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0xfeff*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*u200b*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*u200c*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*u200d*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*u2060*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*u202e*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*ufeff*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-expression*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*iex(*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*iex (*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*frombase64string*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*[scriptblock]::create*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(0x200b|0x200c|0x200d|0x2060|0x202e|0xfeff|u200b|u200c|u200d|u2060|u202e|ufeff)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Invoke-Expression|IEX\(|IEX \(|FromBase64String|\[scriptblock\]::Create)</field>    <description>Invisible Unicode code point rebuilt in a PowerShell script block</description>    <mitre>      <id>T1027.018</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7eb2f807-be72-40db-9998-122dcdc1c296

ATT&CKT1027.018

T1027.018Invisible Unicode

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

One PowerShell EventID 4104 script block that both names an invisible Unicode code point and calls something that executes or decodes a string. AN2063 describes a script that looks benign because its payload is written in characters that do not render, is reconstructed at runtime, and is then followed by child-process or network activity — spread across seven log sources and a UnicodeDensityThreshold knob. Script Block Logging is the only source in the strategy showing the script text, so it is the only one where the invisible-Unicode half is observable. The "follow-on behaviour" clause is a correlation across sources with a time gap, and Sigma expresses neither. This rule is the constructor, not the consequence.

02 · Telemetry you need

product: windows / service: powershell, verbatim from AN2063. EventID: 4104 is pinned inside the detection because that logsource covers 4103–4106 and only 4104 carries ScriptBlockText.
Script Block Logging is off in a default install and in both the Microsoft and CIS baselines. Without it there is no ScriptBlockText field at all and the rule returns zero rows forever — which reads as clean.
One detail in the header: the brief's technique.tactics says stealth, because ATT&CK v19 split Defense Evasion. The rule tags attack.defense-evasion, from sigmaTactics, because attack.stealth resolves to nothing in any Sigma tooling. Here the MITRE-true value is the wrong one to write.

03 · How the logic works

Three selections, all ANDed:

The code points are chosen, not inherited: U+200B/C/D are zero-width space, non-joiner and joiner; U+2060 word joiner; U+202E right-to-left override; U+FEFF byte-order mark. MITRE named the UnicodeCharacterSet knob (on the macOS analytic AN2065) as "zero-width, PUA, bidi" — these six values are the author's. The AND is the rule. Either half alone is worthless: scripts mention BOMs constantly, and FromBase64String is in half the PowerShell on a managed estate. But Sigma has no proximity operator, so in a large module logged as one block the two halves need not be related — one function strips a BOM, an unrelated one decodes base64, and the rule fires. Now the reviewer's findings, mostly about the code-point list: - Six of the twelve terms are written in the wrong language. \u200b is C#/JavaScript escape syntax. PowerShell has no \u escape; its native form, added in 6.0, is ` u{200B} ` — backtick, u, brace. 'u200b' cannot match u{200b}, because the brace sits between the u and the digits. Those six selectors are dead against the only log source the rule reads. - **Only the hexadecimal spelling is covered.** [char]8203, [convert]::ToChar(8203) and '0x20'+'0b' all build the same character and none match. Decimal is arguably the more natural PowerShell idiom and is entirely absent. - **selection_dynamic misses the two commonest iex forms.** IEX( and IEX ( each demand a following parenthesis, so $payload | iex and iex $payload` — the standard cradle idiom — satisfy the code-point half and get dropped by the AND. And the description's honest concession: a script carrying the raw invisible characters rather than naming their code points is invisible to any string match. That is not an obfuscation technique, it is the default. This rule catches the constructor, never the payload.

04 · Common false positives

PowerShell Editor Services and PSReadLine — the reviewer's addition, and
Text-normalisation, localisation and RTL-handling code, naming U+202E and the
Obfuscation research, training material and detection-validation suites.
Accidental base64. u200b is a valid five-character base64 substring, so a

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0920, never executed against a log line. Two of its three selection blocks contain terms that reasoning on paper says cannot fire — exactly the class of defect only real data or a careful reviewer catches.
tier_2: turn Script Block Logging on, then write a benign test script using ` u{200B} `, [char]8203 and $x | iex` and see which variants actually alert. That one exercise validates or kills half the code-point list. Then baseline a week of 4104 from developer hosts and suppress the editor tooling.
tier_3: restores the rest of AN2063 — the script block correlated with the child process or connection it produced, inside a time window — a correlation engine's job, not a Sigma rule's.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Fix the escape forms first. Add u{200b} and its five siblings, or drop
Require a prefix on every code-point term (0x, [char], ` u{ ``) so a
Add the decimal forms 8203, 8204, 8205, 8288, 8238, 65279, gated behind
Widen `selection_dynamic` to | iex, iex , .Invoke() and Add-Type.
MITRE's `ExecutionContext` knob is the intended scoping point, but 4104
Knobs with nothing to bind to: UnicodeDensityThreshold (needs a ratio over

Declared by the author

Large modules logged as a single script block, where one function strips a byte-order mark or a zero-width space from imported text and an unrelated function decodes base64. Sigma has no proximity operator, so the two halves need not be connected in any way for the rule to fire, and this is the most likely benign hit on a host that runs sizeable PowerShell modules.
Text-normalisation, localisation and right-to-left handling code, which names 0x202E and the zero-width joiners on purpose to sanitise or render user-supplied strings correctly.
Obfuscation research, security training material and detection-validation suites, which construct zero-width payloads and evaluate them precisely because that is the behaviour being demonstrated.
Installer and packaging scripts that embed a base64 blob and clean up encoding artefacts in the same block. MITRE's ExecutionContext knob is the intended tuning point here, but 4104 records the interpreter that logged the block rather than a distinct execution context, so scoping has to be done on the host or the calling user.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.018, evaluated against their — events.

Share this rule

/u/siemphony/7eb2f807-be72-40db-9998-122dcdc1c296

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Invisible Unicode code point rebuilt in a PowerShell script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it