Possible Path Obfuscation Using Unicode Space Characters

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the usage of Unicode space characters ranging from U+2000 to U+200A such as En Quad, Em Quad, En Space, Em Spac and so on in file paths. These Unicode space characters can be used to obfuscate file paths, making them appear as regular spaces while actually being different Unicode characters. Attackers could abuse this technique to bypass security detections that do not account for these special characters.

2025-02-11 00:00:00

None

7b50b8a1-4a24-4a6b-bf45-94f9b19f83d6

attack.defense-evasion attack.t1036

Nextron Sigma feed only (private)