huntrule

Windows Process Command Line Contains Emoji Characters

Alerts when a Windows process command line includes emoji characters, which can be used to obscure activity or bypass naive detections.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
@Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
Published
2022-12-05
Updated
2026-07-30
AnalysisDetection

What it detects

This rule flags Windows process creation events where the command line contains one or more emoji characters. Attackers may use non-standard Unicode characters to obscure intent, confuse log parsing, or reduce the effectiveness of simple string-based detections. The detection relies on process creation telemetry, specifically the CommandLine field being captured by Windows auditing or endpoint logging.

Reporting behind it

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.