{
  "rule_ids": [
    "zero_width_chars",
    "variation_selector"
  ],
  "severity": "CRITICAL",
  "command_redacted": "python3 -c \"\nimport os\nimport smtplib\nfrom email.mime.text import MIMEText\nfrom ...",
  "findings": [
    {
      "rule_id": "zero_width_chars",
      "severity": "CRITICAL",
      "title": "Zero-width characters detected",
      "description": "Content contains invisible zero-width characters that could be used to obfuscate URLs or commands",
      "evidence": [
        {
          "type": "byte_sequence",
          "offset": 347,
          "hex": "U+200D",
          "description": "zero-width character U+200D"
        },
        {
          "type": "byte_sequence",
          "offset": 1958,
          "hex": "U+200D",
          "description": "zero-width character U+200D"
        }
      ],
      "mitre_id": "T1036.005"
    },
    {
      "rule_id": "variation_selector",
      "severity": "MEDIUM",
      "title": "Variation selector characters detected",
      "description": "Content contains Unicode variation selectors (VS1-256). These are commonly used in emoji sequences but may indicate steganographic encoding or obfuscation",
      "evidence": [
        {
          "type": "byte_sequence",
          "offset": 353,
          "hex": "U+FE0F",
          "description": "variation selector U+FE0F"
        },
        {
          "type": "byte_sequence",
          "offset": 1964,
          "hex": "U+FE0F",
          "description": "variation selector U+FE0F"
        }
      ],
      "mitre_id": "T1036.005"
    }
  ],
  "timestamp": "2026-08-03T16:16:52.937601468+00:00"
}