Invisible Unicode Tag Phishing Campaign Evading Microsoft 365 Email Filters: Detection and Blocking Guide

---
title: Invisible Unicode Tag Characters in Process Command Line
description: Detects Unicode tag block characters (U+E0001, U+E0020-U+E007F) in process command lines or file names, consistent with phishing-delivered artifacts carrying obfuscated names from the invisible Unicode social engineering campaign. These codepoints are non-rendering and have near-zero legitimate presence on endpoints.
references:
  - https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/09/15
id: 3b7e2a41-9c6d-4f18-b2a5-7d4c8e1f9032
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: '[\u{E0001}\u{E0020}-\u{E007F}]'
falsepositives:
  - Extremely rare; possible in copy-pasted AI model research content or internationalization testing
level: high
---
title: Office Application Spawning Script Engine or Shell After Lure Execution
description: Detects Microsoft Office or email client processes spawning script interpreters, shells, or LOLBins — the common post-click execution chain following a successful financial lure phish. Tuned to exclude known benign Office add-in behavior via unsigned or user-profile child process paths.
references:
  - https://thehackernews.com/2026/09/phishing-campaign-sends-millions-of.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
id: 8f1c5d92-4a7b-4e63-9d01-2b6f3a8c5e47
status: experimental
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msedge.exe'
      - '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  selection_path:
    Image|contains:
      - '\Users\'
      - '\Temp\'
      - '\AppData\'
      - '\ProgramData\'
  condition: all of selection_*
falsepositives:
  - Legitimate Office add-ins and line-of-business integrations spawning scripts (typically signed and in Program Files — the user-profile path filter excludes most)
  - Browser-launched enterprise SSO tooling; baseline and exclude per environment
level: high

// Hunt 1: Inbound email containing invisible Unicode tag characters in the subject
// Tag block: U+E0001 and U+E0020-U+E007F — near-zero legitimate use in business mail
EmailEvents
| where TimeGenerated > ago(14d)
| where EmailDirection == "Inbound"
| where Subject matches regex @"[\x{E0001}\x{E0020}-\x{E007F}]"
| project TimeGenerated, SenderFromAddress, SenderFromDomain, RecipientEmailAddress,
          Subject, NetworkMessageId, ThreatTypes, DetectionMethods, EmailAction
| order by TimeGenerated desc
;

// Hunt 2: Financial-lure keyword mail from first-time senders (catches variants
// where tag chars appear only in the body, not the subject)
let FinancialLures = dynamic(["funding","invoice","payment","wire transfer","remittance","purchase order","ach","quote","statement"]);
let KnownSenders = EmailEvents
    | where TimeGenerated > ago(90d) and TimeGenerated < ago(14d)
    | where EmailDirection == "Inbound"
    | summarize by SenderFromAddress;
EmailEvents
| where TimeGenerated > ago(14d)
| where EmailDirection == "Inbound"
| where Subject has_any (FinancialLures)
| where SenderFromAddress !in (KnownSenders)
| summarize MessageCount = count(), Recipients = dcount(RecipientEmailAddress),
            SampleSubjects = make_set(Subject, 5) by SenderFromAddress, SenderFromDomain
| where MessageCount > 5
| order by MessageCount desc
;

// Hunt 3: Post-click execution — Office/browser spawning script engines from user paths
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","msedge.exe","chrome.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","curl.exe","bitsadmin.exe")
| where FolderPath has_any (@"\Users\", @"\Temp\", @"\AppData\", @"\ProgramData\")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          FileName, ProcessCommandLine, FolderPath, SHA256
| order by TimeGenerated desc

-- Hunt for email-delivered lure artifacts with Mark-of-the-Web in user-writable locations
-- Targets file types common in financial-lure phishing: .url, .html, .svg, .lnk, archives, disk images
LET suspicious_ext = '(?i)\.(url|html|htm|svg|lnk|iso|img|zip|js|vbs)$'

SELECT FullPath,
       Size,
       Mtime,
       Btime,
       read_file(filename=FullPath + ':Zone.Identifier', length=512) AS MOTW
FROM glob(globs=[
  'C:/Users/*/Downloads/*',
  'C:/Users/*/Desktop/*',
  'C:/Users/*/AppData/Local/Temp/*',
  'C:/Users/*/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/**/*'
])
WHERE FullPath =~ suspicious_ext
  AND Mtime > ago(7 * 24 * 3600)
  AND MOTW =~ 'ZoneId=3'
ORDER BY Mtime DESC

# Block invisible Unicode tag characters at the Exchange Online transport layer.
# Requires: ExchangeOnlineManagement module and Exchange Administrator (or Transport Rules) role.
# The pattern is built from codepoints programmatically so editors/clipboard cannot strip the non-printing characters.

Connect-ExchangeOnline

# Tag block: U+E0001 (LANGUAGE TAG) and U+E0020-U+E007F (TAG characters)
$tagPattern = "[{0}{1}-{2}]" -f [char]0xE0001, [char]0xE0020, [char]0xE007F

# Sanity check: the pattern must match a split lure word and must NOT match normal text
"fu$([char]0xE0020)nding" -match $tagPattern   # Expected: True
"normal funding request" -match $tagPattern    # Expected: False

# Deploy in Audit mode first, review for 48-72 hours, then flip to Enforce
New-TransportRule -Name "SEC-ARSN-Quarantine-Invisible-Unicode-Tags" `
    -SubjectOrBodyMatchesPatterns $tagPattern `
    -Quarantine $true `
    -Mode Audit `
    -Priority 0 `
    -Comments "Quarantines messages containing Unicode tag block characters used to split lure keywords past filters. Ref: Microsoft Security Research invisible Unicode campaign, Sept 2026."

# Verify rule creation and inspect matched message counts during the audit window
Get-TransportRule -Identity "SEC-ARSN-Quarantine-Invisible-Unicode-Tags" | Format-List Name, State, Mode, Priority, SubjectOrBodyMatchesPatterns
Get-TransportRuleAction -Name "SEC-ARSN-Quarantine-Invisible-Unicode-Tags" | Format-List

# After audit validation, enforce:
# Set-TransportRule -Identity "SEC-ARSN-Quarantine-Invisible-Unicode-Tags" -Mode Enforce

# Hunting note: message trace does not expose body content. For retro hunting across delivered mail,
# use Defender for Office 365 Explorer (Threat Explorer) filtered on the Subject regex from the KQL section,
# or export via Graph API and scan body content for the tag range client-side.