
Summary
This detection rule targets malicious attachments that use Braille Pattern Blank characters to obscure their file extensions. The rule is designed to recursively examine incoming attachments, looking for hidden indicators that can signify attempts to bypass standard security measures. The main goal is to prevent malware or ransomware that employs this technique from reaching the end-user. By detecting any files with names that include the Unicode Braille Pattern Blank character (U+2800) or by examining common archive file extensions associated with such files, the rule helps in revealing potentially malicious content attempting to disguise itself. The severity of this rule is classified as high due to the potential risks involved with malware delivery through obfuscation tactics.
Categories
- Endpoint
- Cloud
- Web
- Application
Data Sources
- File
- Process
- Network Traffic
- User Account
Created: 2025-02-20