ESX BusyBox - Zero-Width Unicode Command Obfuscation
Detects awk-based shell command construction on ESX BusyBox that interleaves an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space, zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21 validated ESX obfuscation techniques that leaves only the invisible-character-laden string in shell logs while the executed command is fully hidden from cleartext review.
YARA-L
