{
  "rule_ids": [
    "variation_selector"
  ],
  "severity": "MEDIUM",
  "command_redacted": "printf '%s\\n' \"[2026-09-29 13:53+0800] webhook(media-library-watch, 触发 /mnt/...",
  "findings": [
    {
      "rule_id": "variation_selector",
      "severity": "MEDIUM",
      "title": "Variation selector characters detected",
      "description": "Content contains Unicode variation selectors (VS1-256). These are commonly used in emoji sequences but may indicate steganographic encoding or obfuscation",
      "evidence": [
        {
          "type": "byte_sequence",
          "offset": 1635,
          "hex": "U+FE0F",
          "description": "variation selector U+FE0F"
        },
        {
          "type": "byte_sequence",
          "offset": 1677,
          "hex": "U+FE0F",
          "description": "variation selector U+FE0F"
        }
      ],
      "mitre_id": "T1036.005"
    }
  ],
  "timestamp": "2026-09-29T05:53:38.236803701+00:00"
}