tfMITRE ATT&CK sub-technique

Invisible Unicode T1027.018

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 22 April 2026
Last modified: 12 May 2026
Contributors: Menachem Goldstein; Rich Rafferty (NR Labs)

Adversaries may abuse invisible or non-printing Unicode characters to conceal malicious content within files, scripts, or text. By inserting characters that do not visibly render, adversaries may hide data, alter how content is interpreted, or make malicious code appear as benign text or whitespace. Adversaries may encode these malicious payloads, using binary, Base64, or custom schemes, to be reconstructed at runtime through scripting features such as JavaScript Proxy traps, eval(), or other dynamic execution methods. This technique enables adversaries to evade visual inspection and basic static analysis by hiding malicious encoded content in innocuous text.[1][2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Invisible Unicode MITRE reference T1027.018

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

GlassWormS9010 ↗

Has utilized invisible Unicode Private Use Area (PUA) characters to obfuscate its malicious code so that it does not render in code editors.1 2 3

created 2026-04-10MALWARE

All 1 software entries for this technique

Offense vs defense T1027.018

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Invisible Unicode detection strategy DET0920

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Invisible Unicode

Enterprise

3 platforms

AN2063 · Windows

Detection identifies execution of scripts or files that appear visually benign (low printable character ratio) but result in runtime decoding, dynamic evaluation, and subsequent process or network activity. Correlation links script execution with abnormal Unicode density and follow-on behavior such as child process creation or outbound connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Script ExecutionDC0029	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllocationSizeThreshold	To tune for atypical virtual memory allocations that might indicate non-rendering characters in dense files
ExecutionContext	Allows tuning for atypical processes from script execution (e.g., powershell.exe, wscript.exe, mshta.exe)
UnicodeDensityThreshold	Tune for invisible characters, or atypical amounts of Unicode characters (U+...)

AN2064 · Linux

Detection identifies execution of scripts containing high concentrations of invisible Unicode characters followed by decoding or interpretation behaviors (e.g., base64 decode, eval) and subsequent process or network activity. Emphasis is placed on mismatch between file entropy/structure and execution output.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File MetadataDC0059	auditd:SYSCALL	stat and lstat syscall results on files, including inode and permission info
Command ExecutionDC0064	auditd:EXECVE	execve of script/interpreter (bash, python, node) with suspicious encoded or non-printable content

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DecodeUtility	May include base64
EntropyThreshold	Useful for tuning sections containing high entropy indicative of Unicode sequences

AN2065 · macOS

Detection identifies execution of scripts or applications containing invisible Unicode payloads reconstructed at runtime, correlated with abnormal AppleScript, JavaScript for Automation, or shell execution and subsequent process or network behavior inconsistent with visible file content.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	macOS:unifiedlog	looking for file access to scripts with abnormal encoding patterns
Command ExecutionDC0064	macos:unifiedlog	Execution of osascript, sh, bash, zsh, installer, open
Network Connection CreationDC0082	NSM:Flow	log entries indicating network connection initiation on macOS

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionContext	Use of abnormal AppleScript or JavaScript functions (such as eval()) not typically expected
UnicodeCharacterSet	Specific unicode ranges monitored (zero-width, PUA, bidi)

Tests3ExecutorsPowerShell 3Need elevation0 of 3Have prerequisites0Have cleanup3Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	File Masquerading with Zero-Width Space	windows	PowerShell	—	—	Yes
Creates a file named 'secret.txt' but inserts a Zero-Width Space (U+200B) before the extension. This emulates how adversaries hide malicious files in plain sight, as they appear identical to legitimate files in File Explorer. Attack command $fileName = "secret" + [char]0x200B + ".txt" New-Item -Path "$env:TEMP\$fileName" -ItemType "file" -Value "Hidden Unicode Content" -Force Write-Host "Created file: $env:TEMP\$fileName" Cleanup command $fileName = "secret" + [char]0x200B + ".txt" Remove-Item -Path "$env:TEMP\$fileName" -ErrorAction Ignore GUID427c68a4-2aba-40e9-865f-678f2c1915e3
02	Invisible Unicode in Environment Variables	windows	PowerShell	—	—	Yes
Sets an environment variable that includes a Zero-Width Non-Joiner (U+200C). This emulates techniques used to hide configuration data or persistence paths from administrators performing manual audits. Attack command $varName = "PATH" + [char]0x200C [Environment]::SetEnvironmentVariable($varName, "C:\Users\Public\Malicious", "User") Write-Host "Hidden environment variable '$varName' set." Cleanup command $varName = "PATH" + [char]0x200C [Environment]::SetEnvironmentVariable($varName, $null, "User") GUID5ee261b8-6cca-4348-93f5-84975b46b3f6
03	Binary Masquerading via Invisible Unicode	windows	PowerShell	—	—	Yes
Copies a system binary (calc.exe) to a new name containing an invisible character (U+200D) and executes it. This tests the ability of EDRs to handle non-normalized file paths in process execution events. Attack command $hiddentarget = "$env:TEMP\calc" + [char]0x200D + ".exe" Copy-Item "C:\Windows\System32\calc.exe" -Destination $hiddentarget Start-Process $hiddentarget Cleanup command $hiddentarget = "$env:TEMP\calc" + [char]0x200D + ".exe" Stop-Process -Name "calc*" -ErrorAction Ignore Remove-Item $hiddentarget -ErrorAction Ignore GUID21ced015-a791-4f17-b6bf-9954353b7b7d

Tests from Atomic Red Team (MIT licence) · technique definition

Invisible Unicode detections T1027.018

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs