TLDR: The M365 Defender alert "Email messages containing malicious URL removed after delivery" has a hidden non-printable character at the end of the alert, the Zero-Width Space (ZWSP) character.
I was working to implement the SocRA Watchlist by @RinUre in Sentinel and was eager to extend the included list with a few simple remediation steps. Luckily for this post the very first alert I chose to extend has a hidden non-printable character, the Zero-Width Space (ZWSP) character.
After significant head scratching on why my watchlist was not triggered for the alert I found that: "Email messages containing malicious URL removed after delivery" has the non-printable character after the 'y' in delivery. I have copied the alert title in both Chrome and Edge as well as 2 Azure tenants and the ZWSP character is consistent.
You can test this yourself by searching for the alert and copying the full title and running the below code which converts the string to its decimal unicode equivalent:
$string = "Email messages containing malicious URL removed after delivery"
$string -split '' | %{[int][char]$_}
You should see the final output as below:
101
114
121
8203
The '8203' being the ZWSP character where '121' is 'y'.
It would be great to have this confirmed by other users and remediated by the relevant MS team. While knowing about it one can simply include the ZWSP in relevant watchlists or automation it's going to bite at some point.
Thanks.
