AN2063
Analytic 2063
Windows
Detection identifies execution of scripts or files that appear visually benign (low printable character ratio) but result in runtime decoding, dynamic evaluation, and subsequent process or network activity. Correlation links script execution with abnormal Unicode density and follow-on behavior such as child process creation or outbound connections.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=7
[AllocationSizeThreshold]
To tune for atypical virtual memory allocations that might indicate non-rendering characters in dense files
[ExecutionContext]
Allows tuning for atypical processes from script execution (e.g., powershell.exe, wscript.exe, mshta.exe)
[UnicodeDensityThreshold]
Tune for invisible characters, or atypical amounts of Unicode characters (U+...)
AN2064
Analytic 2064
Linux
Detection identifies execution of scripts containing high concentrations of invisible Unicode characters followed by decoding or interpretation behaviors (e.g., base64 decode, eval) and subsequent process or network activity. Emphasis is placed on mismatch between file entropy/structure and execution output.
auditd:SYSCALL
stat and lstat syscall results on files, including inode and permission info
auditd:EXECVE
execve of script/interpreter (bash, python, node) with suspicious encoded or non-printable content
[DecodeUtility]
May include base64
[EntropyThreshold]
Useful for tuning sections containing high entropy indicative of Unicode sequences
AN2065
Analytic 2065
macOS
Detection identifies execution of scripts or applications containing invisible Unicode payloads reconstructed at runtime, correlated with abnormal AppleScript, JavaScript for Automation, or shell execution and subsequent process or network behavior inconsistent with visible file content.
NSM:Flow
log entries indicating network connection initiation on macOS
macos:unifiedlog
Execution of osascript, sh, bash, zsh, installer, open
macOS:unifiedlog
looking for file access to scripts with abnormal encoding patterns
[ExecutionContext]
Use of abnormal AppleScript or JavaScript functions (such as eval()) not typically expected
[UnicodeCharacterSet]
Specific unicode ranges monitored (zero-width, PUA, bidi)