heroui logo

Evasion: Variation selectors in subject line

Sublime Rules

View Source
Summary
Detects inbound messages where invisible Unicode variation selector characters (U+FE00 to U+FE0D) are inserted after alphanumeric characters in the subject line. This is a known evasion technique used to split or obfuscate words, allowing the text to render normally to recipients while bypassing keyword-based or pattern-based detection systems. The rule triggers when the inbound context (type.inbound) shows a subject.base containing an alphanumeric character followed by a variation selector, using a regex pattern that targets the range of variation selectors. This supports identifying spam, credential phishing, or BEC/fraud attempts that employ subject-line evasion.
Categories
  • Other
Data Sources
  • Network Traffic
  • Application Log
Created: 2026-08-29