Windows Process Command Line Contains Emoji Characters
Alerts when a Windows process command line includes emoji characters, which can be used to obscure activity or bypass naive detections.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- @Kostastsale, TheDFIRReport (SigmaHQ), DRL 1.1
- Published
- 2022-12-05
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the command line contains one or more emoji characters. Attackers may use non-standard Unicode characters to obscure intent, confuse log parsing, or reduce the effectiveness of simple string-based detections. The detection relies on process creation telemetry, specifically the CommandLine field being captured by Windows auditing or endpoint logging.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-command-line-contains-emoji-characters-f9578658
title: Windows Process Command Line Contains Emoji Characters
id: 8c7bc197-6bde-4d1b-b407-ea85ae93dfce
status: test
description: This rule flags Windows process creation events where the command line contains one or more emoji characters. Attackers may use non-standard Unicode characters to obscure intent, confuse log parsing, or reduce the effectiveness of simple string-based detections. The detection relies on process creation telemetry, specifically the CommandLine field being captured by Windows auditing or endpoint logging.
author: "@Kostastsale, TheDFIRReport, Huntrule Team"
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml
tags:
- attack.stealth
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- 🦆
- 🦅
- 🦉
- 🦇
- 🐺
- 🐗
- 🐴
- 🦄
- 🐝
- 🪱
- 🐛
- 🦋
- 🐌
- 🐞
- 🐜
- 🪰
- 🪲
- 🪳
- 🦟
- 🦗
- 🕷
- 🕸
- 🦂
- 🐢
- 🐍
- 🦎
- 🦖
- 🦕
- 🐙
- 🦑
- 🦐
- 🦞
- 🦀
- 🪸
- 🐡
- 🐠
- 🐟
- 🐬
- 🐳
- 🐋
- 🦈
- 🐊
- 🐅
- 🐆
- 🦓
- 🦍
- 🦧
- 🦣
- 🐘
- 🦛
- 🦏
- 🐪
- 🐫
- 🦒
- 🦘
- 🦬
- 🐃
- 🐂
- 🐄
- 🐎
- 🐖
- 🐏
- 🐑
- 🦙
- 🐐
- 🦌
- 🐕
- 🐩
- 🦮
- 🐕🦺
- 🐈
- 🐈⬛
- 🪶
- 🐓
- 🦃
- 🦤
- 🦚
- 🦜
- 🦢
- 🦩
- 🕊
- 🐇
- 🦝
- 🦨
- 🦡
- 🦫
- 🦦
- 🦥
- 🐁
- 🐀
- 🐿
- 🦔
- 🐾
- 🐉
- 🐲
- 🌵
- 🎄
- 🌲
- 🌳
- 🌴
- 🪹
- 🪺
- 🪵
- 🌱
- 🌿
- ☘️
- 🍀
- 🎍
- 🪴
- 🎋
- 🍃
- 🍂
- 🍁
- 🍄
- 🐚
- 🪨
- 🌾
- 💐
- 🌷
- 🪷
- 🌹
- 🥀
- 🌺
- 🌸
- 🌼
- 🌻
- 🌞
- 🌝
- 🌛
- 🌜
- 🌚
- 🌕
- 🌖
- 🌗
- 🌘
- 🌑
- 🌒
- 🌓
- 🌔
- 🌙
- 🌎
- 🌍
- 🌏
- 🪐
- 💫
- ⭐️
- 🌟
- ✨
- ⚡️
- ☄️
- 💥
- 🔥
- 🌪
- 🌈
- ☀️
- 🌤
- ⛅️
- 🌥
- ☁️
- 🌦
- 🌧
- ⛈
- 🌩
- 🌨
- ❄️
- ☃️
- ⛄️
- 🌬
- 💨
- 💧
- 💦
- 🫧
- ☔️
- ☂️
- 🌊
- 🌫🍏
- 🍎
- 🍐
- 🍊
- 🍋
- 🍌
- 🍉
- 🍇
- 🍓
- 🫐
- 🍈
- 🍒
- 🍑
- 🥭
- 🍍
- 🥥
- 🥝
- 🍅
- 🍆
- 🥑
- 🥦
- 🥬
- 🥒
- 🌶
- 🫑
- 🌽
- 🥕
- 🫒
- 🧄
- 🧅
- 🥔
- 🍠
- 🫘
- 🥐
- 🥯
- 🍞
- 🥖
- 🥨
- 🧀
- 🥚
- 🍳
- 🧈
- 🥞
- 🧇
- 🥓
- 🥩
- 🍗
- 🍖
- 🦴
- 🌭
- 🍔
- 🍟
- 🍕
- 🫓
- 🥪
- 🥙
- 🧆
- 🌮
- 🌯
- 🫔
- 🥗
- 🥘
- 🫕
- 🥫
- 🍝
- 🍜
- 🍲
- 🍛
- 🍣
- 🍱
- 🥟
- 🦪
- 🍤
- 🍙
- 🍚
- 🍘
- 🍥
- 🥠
- 🥮
- 🍢
- 🍡
- 🍧
- 🍨
- 🍦
- 🥧
- 🧁
- 🍰
- 🎂
- 🍮
- 🍭
- 🍬
- 🍫
- 🍿
- 🍩
- 🍪
- 🌰
- 🥜
- 🍯
- 🥛
- 🍼
- 🫖
- ☕️
- 🍵
- 🧃
- 🥤
- 🧋
- 🫙
- 🍶
- 🍺
- 🍻
- 🥂
- 🍷
- 🫗
- 🥃
- 🍸
- 🍹
- 🧉
- 🍾
- 🧊
- 🥄
- 🍴
- 🍽
- 🥣
- 🥡
- 🥢
- 🧂
- ⚽️
- 🏀
- 🏈
- ⚾️
- 🥎
- 🎾
- 🏐
- 🏉
- 🥏
- 🎱
- 🪀
- 🏓
- 🏸
- 🏒
- 🏑
- 🥍
- 🏏
- 🪃
- 🥅
- ⛳️
- 🪁
- 🏹
- 🎣
- 🤿
- 🥊
- 🥋
- 🎽
- 🛹
- 🛼
- 🛷
- ⛸
- 🥌
- 🎿
- ⛷
- 🏂
- 🪂
- 🏋️♀️
- 🏋️
- 🏋️♂️
- 🤼♀️
- 🤼
- 🤼♂️
- 🤸♀️
- 🤸
- 🤸♂️
- ⛹️♀️
- ⛹️
- ⛹️♂️
- 🤺
- 🤾♀️
- 🤾
- 🤾♂️
- 🏌️♀️
- 🏌️
- 🏌️♂️
- 🏇
- 🧘♀️
- 🧘
- 🧘♂️
- 🏄♀️
- 🏄
- 🏄♂️
- 🏊♀️
- 🏊
- 🏊♂️
- 🤽♀️
- 🤽
- 🤽♂️
- 🚣♀️
- 🚣
- 🚣♂️
- 🧗♀️
- 🧗
- 🧗♂️
- 🚵♀️
- 🚵
- 🚵♂️
- 🚴♀️
- 🚴
- 🚴♂️
- 🏆
- 🥇
- 🥈
- 🥉
- 🏅
- 🎖
- 🏵
- 🎗
- 🎫
- 🎟
- 🎪
- 🤹
- 🤹♂️
- 🤹♀️
- 🎭
- 🩰
- 🎨
- 🎬
- 🎤
- 🎧
- 🎼
- 🎹
- 🥁
- 🪘
- 🎷
- 🎺
- 🪗
- 🎸
- 🪕
- 🎻
- 🎲
- ♟
- 🎯
- 🎳
- 🎮
- 🎰
- 🧩
- 🚗
- 🚕
- 🚙
- 🚌
- 🚎
- 🏎
- 🚓
- 🚑
- 🚒
- 🚐
- 🛻
- 🚚
- 🚛
- 🚜
- 🦯
- 🦽
- 🦼
- 🛴
- 🚲
- 🛵
- 🏍
- 🛺
- 🚨
- 🚔
- 🚍
- 🚘
- 🚖
- 🛞
- 🚡
- 🚠
- 🚟
- 🚃
- 🚋
- 🚞
- 🚝
- 🚄
- 🚅
- 🚈
- 🚂
- 🚆
- 🚇
- 🚊
- 🚉
- ✈️
- 🛫
- 🛬
- 🛩
- 💺
- 🛰
- 🚀
- 🛸
- 🚁
- 🛶
- ⛵️
- 🚤
- 🛥
- 🛳
- ⛴
- 🚢
- ⚓️
- 🛟
- 🪝
- ⛽️
- 🚧
- 🚦
- 🚥
- 🚏
- 🗺
- 🗿
- 🗽
- 🗼
- 🏰
- 🏯
- 🏟
- 🎡
- 🎢
- 🛝
- 🎠
- ⛲️
- ⛱
- 🏖
- 🏝
- 🏜
- 🌋
- ⛰
- 🏔
- 🗻
- 🏕
- ⛺️
- 🛖
- 🏠
- 🏡
- 🏘
- 🏚
- 🏗
- 🏭
- 🏢
- 🏬
- 🏣
- 🏤
- 🏥
- 🏦
- 🏨
- 🏪
- 🏫
- 🏩
- 💒
- 🏛
- ⛪️
- 🕌
- 🕍
- 🛕
- 🕋
- ⛩
- 🛤
- 🛣
- 🗾
- 🎑
- 🏞
- 🌅
- 🌄
- 🌠
- 🎇
- 🎆
- 🌇
- 🌆
- 🏙
- 🌃
- 🌌
- 🌉
- 🌁
- ⌚️
- 📱
- 📲
- 💻
- ⌨️
- 🖥
- 🖨
- 🖱
- 🖲
- 🕹
- 🗜
- 💽
- 💾
- 💿
- 📀
- 📼
- 📷
- 📸
- 📹
- 🎥
- 📽
- 🎞
- 📞
- ☎️
- 📟
- 📠
- 📺
- 📻
- 🎙
- 🎚
- 🎛
- 🧭
- ⏱
- ⏲
- ⏰
- 🕰
- ⌛️
- ⏳
- 📡
- 🔋
- 🪫
- 🔌
- 💡
- 🔦
- 🕯
- 🪔
- 🧯
- 🛢
- 💸
- 💵
- 💴
- 💶
- 💷
- 🪙
- 💰
- 💳
- 💎
- ⚖️
- 🪜
- 🧰
- 🪛
- 🔧
- 🔨
- ⚒
- 🛠
- ⛏
- 🪚
- 🔩
- ⚙️
- 🪤
- 🧱
- ⛓
- 🧲
- 🔫
- 💣
- 🧨
- 🪓
- 🔪
- 🗡
- ⚔️
- 🛡
- 🚬
- ⚰️
- 🪦
- ⚱️
- 🏺
- 🔮
- 📿
- 🧿
- 🪬
- 💈
- ⚗️
- 🔭
- 🔬
- 🕳
- 🩹
- 🩺
- 🩻
- 🩼
- 💊
- 💉
- 🩸
- 🧬
- 🦠
- 🧫
- 🧪
- 🌡
- 🧹
- 🪠
- 🧺
- 🧻
- 🚽
- 🚰
- 🚿
- 🛁
- 🛀
- 🧼
- 🪥
- 🪒
- 🧽
- 🪣
- 🧴
- 🛎
- 🔑
- 🗝
- 🚪
- 🪑
- 🛋
- 🛏
- 🛌
- 🧸
- 🪆
- 🖼
- 🪞
- 🪟
- 🛍
- 🛒
- 🎁
- 🎈
- 🎏
- 🎀
- 🪄
- 🪅
- 🎊
- 🎉
- 🪩
- 🎎
- 🏮
- 🎐
- 🧧
- ✉️
- 📩
- 📨
- 📧
- 💌
- 📥
- 📤
- 📦
- 🏷
- 🪧
- 📪
- 📫
- 📬
- 📭
- 📮
- 📯
- 📜
- 📃
- 📄
- 📑
- 🧾
- 📊
- 📈
- 📉
- 🗒
- 🗓
- 📆
- 📅
- 🗑
- 🪪
- 📇
- 🗃
- 🗳
- 🗄
- 📋
- 📁
- 📂
- 🗂
- 🗞
- 📰
- 📓
- 📔
- 📒
- 📕
- 📗
- 📘
- 📙
- 📚
- 📖
- 🔖
- 🧷
- 🔗
- 📎
- 🖇
- 📐
- 📏
- 🧮
- 📌
- 📍
- ✂️
- 🖊
- 🖋
- ✒️
- 🖌
- 🖍
- 📝
- ✏️
- 🔍
- 🔎
- 🔏
- 🔐
- 🔒
- 🔓❤️
- 🧡
- 💛
- 💚
- 💙
- 💜
- 🖤
- 🤍
- 🤎
- ❤️🔥
- ❤️🩹
- 💔
- ❣️
- 💕
- 💞
- 💓
- 💗
- 💖
- 💘
- 💝
- 💟
- ☮️
- ✝️
- ☪️
- 🕉
- ☸️
- ✡️
- 🔯
- 🕎
- ☯️
- ☦️
- 🛐
- ⛎
- ♈️
- ♉️
- ♊️
- ♋️
- ♌️
- ♍️
- ♎️
- ♏️
- ♐️
- ♑️
- ♒️
- ♓️
- 🆔
- ⚛️
- 🉑
- ☢️
- ☣️
- 📴
- 📳
- 🈶
- 🈚️
- 🈸
- 🈺
- 🈷️
- ✴️
- 🆚
- 💮
- 🉐
- ㊙️
- ㊗️
- 🈴
- 🈵
- 🈹
- 🈲
- 🅰️
- 🅱️
- 🆎
- 🆑
- 🅾️
- 🆘
- ❌
- ⭕️
- 🛑
- ⛔️
- 📛
- 🚫
- 💯
- 💢
- ♨️
- 🚷
- 🚯
- 🚳
- 🚱
- 🔞
- 📵
- 🚭
- ❗️
- ❕
- ❓
- ❔
- ‼️
- ⁉️
- 🔅
- 🔆
- 〽️
- ⚠️
- 🚸
- 🔱
- ⚜️
- 🔰
- ♻️
- ✅
- 🈯️
- 💹
- ❇️
- ✳️
- ❎
- 🌐
- 💠
- Ⓜ️
- 🌀
- 💤
- 🏧
- 🚾
- ♿️
- 🅿️
- 🛗
- 🈳
- 🈂️
- 🛂
- 🛃
- 🛄
- 🛅
- 🚹
- 🚺
- 🚼
- ⚧
- 🚻
- 🚮
- 🎦
- 📶
- 🈁
- 🔣
- ℹ️
- 🔤
- 🔡
- 🔠
- 🆖
- 🆗
- 🆙
- 🆒
- 🆕
- 🆓
- 0️⃣
- 1️⃣
- 2️⃣
- 3️⃣
- 4️⃣
- 5️⃣
- 6️⃣
- 7️⃣
- 8️⃣
- 9️⃣
- 🔟
- 🔢
- "#️⃣"
- "*️⃣"
- ⏏️
- ▶️
- ⏸
- ⏯
- ⏹
- ⏺
- ⏭
- ⏮
- ⏩
- ⏪
- ⏫
- ⏬
- ◀️
- 🔼
- 🔽
- ➡️
- ⬅️
- ⬆️
- ⬇️
- ↗️
- ↘️
- ↙️
- ↖️
- ↕️
- ↔️
- ↪️
- ↩️
- ⤴️
- ⤵️
- 🔀
- 🔁
- 🔂
- 🔄
- 🔃
- 🎵
- 🎶
- ➕
- ➖
- ➗
- ✖️
- 🟰
- ♾
- 💲
- 💱
- ™️
- ©️
- ®️
- 〰️
- ➰
- ➿
- 🔚
- 🔙
- 🔛
- 🔝
- 🔜
- ✔️
- ☑️
- 🔘
- 🔴
- 🟠
- 🟡
- 🟢
- 🔵
- 🟣
- ⚫️
- ⚪️
- 🟤
- 🔺
- 🔻
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f9578658-9e71-4711-b634-3f9b50cd3c06
type: derived