Techniques › T1027.018 › AN2063
AN2063 Analytic 2063
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection identifies execution of scripts or files that appear visually benign (low printable character ratio) but result in runtime decoding, dynamic evaluation, and subsequent process or network activity. Correlation links script execution with abnormal Unicode density and follow-on behavior such as child process creation or outbound connections.</p>
- Detects
- T1027.018 Invisible Unicode
- Part of
- DET0920 Detection Strategy for Invisible Unicode
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0029 Script Execution |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllocationSizeThreshold | To tune for atypical virtual memory allocations that might indicate non-rendering characters in dense files |
ExecutionContext | Allows tuning for atypical processes from script execution (e.g., powershell.exe, wscript.exe, mshta.exe) |
UnicodeDensityThreshold | Tune for invisible characters, or atypical amounts of Unicode characters (U+...) |