Suspicious File Creation with Unicode Space Characters

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects when files are created with filenames or file paths containing Unicode characters from U+2000 to U+200A. These Unicode space characters can be used to obfuscate file paths, making them appear as regular spaces while actually being different Unicode characters. Attackers often use these space characters for path/file obfuscation to evade security detections.

2025-02-12 00:00:00

None

512b8fa5-b9c6-4c48-b0e5-bafdb9f7e4be

attack.defense-evasion attack.t1036

Nextron Sigma feed only (private)